import type { NoydbStore } from '../../kernel/types.js';
import { type EnclaveKey } from '../../kernel/enclave/index.js';
import { type AttestationFieldSchema, type QrPayload } from '@noy-db/attestation';
/** Everything issueAttestationCore needs from the Vault, injected for testability. */
export interface IssueContext {
    readonly store: NoydbStore;
    readonly vault: string;
    readonly role: string;
    /** The _attestations collection DEK (AES-KW-wrapped under KEK by the keyring). */
    getDEK(): Promise<EnclaveKey>;
    /** Decrypted source record + its envelope version, or null if absent. */
    readRecord(collection: string, id: string): Promise<{
        record: Record<string, unknown>;
        version: number;
    } | null>;
}
export interface IssueArgs {
    readonly collection: string;
    readonly id: string;
    readonly fieldSchema: AttestationFieldSchema;
}
export interface IssueResult {
    readonly docId: string;
    readonly qr: string;
    readonly payload: QrPayload;
    readonly keyId: string;
    readonly publicKeyB64: string;
}
export declare function issueAttestationCore(ctx: IssueContext, args: IssueArgs): Promise<IssueResult>;