import type { NoydbStore } from '../../kernel/types.js';
import { type EnclaveKey } from '../../kernel/enclave/index.js';
export declare const ATTESTATIONS_COLLECTION = "_attestations";
export declare const SIGNER_RECORD_ID = "_signer";
export declare const REVOKED_RECORD_ID = "_revoked";
export interface DocSigner {
    readonly keyId: string;
    readonly publicKeyB64: string;
    readonly privateKeyPkcs8B64: string;
}
/**
 * Pure read: return the firm's persisted document-signing keypair, or `null`
 * if none has been minted yet. Never writes — callers that must NOT mint
 * (e.g. an ungated public-key getter) use this instead of `loadOrCreateSigner`.
 *
 * Stored as an encrypted record `_attestations/_signer` under the
 * `_attestations` collection DEK (resolved via `getDEK`, which is
 * AES-KW-wrapped under the owner KEK + persisted by the keyring). The KEK
 * itself is AES-KW-only and cannot AES-GCM-encrypt these bytes — hence
 * storage under a normal collection DEK.
 */
export declare function loadSigner(store: NoydbStore, vault: string, getDEK: (collection: string) => Promise<EnclaveKey>): Promise<DocSigner | null>;
/**
 * Lazily mint (or load) the firm's Ed25519 document-signing keypair.
 *
 * On a concurrent first-mint, two callers can both read `null` and both mint
 * distinct keypairs. The `put(…, expectedVersion: 0)` ("must not already
 * exist") lets exactly one win; the loser catches `ConflictError`, re-reads,
 * and returns the winner's signer — converging on a single keypair rather than
 * clobbering it or surfacing a raw conflict. (All real stores treat a missing
 * record + `ev: 0` as a no-conflict write, so the catch fires on lost-race only.)
 */
export declare function loadOrCreateSigner(store: NoydbStore, vault: string, getDEK: (collection: string) => Promise<EnclaveKey>): Promise<DocSigner>;