import type { NoydbStore } from '../../kernel/types.js';
import type { EnclaveKey } from '../../kernel/enclave/index.js';
import type { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
import type { AttestationStrategy } from './strategy.js';
export { NO_ATTESTATION, type AttestationStrategy } from './strategy.js';
/** Everything the moving attestation methods touched on the vault's `this.*`. */
export interface VaultAttestationDeps {
    /** The ciphertext store. */
    readonly adapter: NoydbStore;
    /** Vault namespace name. */
    readonly vault: string;
    /** Per-collection DEK resolver (bound `vault.getDEK`). */
    readonly getDEK: (collection: string) => Promise<EnclaveKey>;
    /** The invoking keyring's role (read fresh per call). */
    role(): string;
    /** Decrypt a collection record at `locale: 'raw'` (issue side reads the live record). */
    getRawRecord(collection: string, id: string): Promise<Record<string, unknown> | null>;
}
export declare class VaultAttestation {
    private readonly deps;
    /**
     * Opt-in capability gate. `NO_ATTESTATION` when
     * `createNoydb({ attestationStrategy })` was omitted — every issue/revoke/
     * signer call then throws `AttestationNotEnabledError`. The facade always
     * exists (it holds the per-collection field-schema registry populated at
     * `collection()` time); only the capability methods are gated.
     */
    private readonly strategy;
    /**
     * Per-collection attestation field-schema (issue side). Populated on
     * `collection({ attestation })` via {@link register} and read by
     * {@link issue}. Indexed by collection name.
     */
    private readonly registry;
    constructor(deps: VaultAttestationDeps, 
    /**
     * Opt-in capability gate. `NO_ATTESTATION` when
     * `createNoydb({ attestationStrategy })` was omitted — every issue/revoke/
     * signer call then throws `AttestationNotEnabledError`. The facade always
     * exists (it holds the per-collection field-schema registry populated at
     * `collection()` time); only the capability methods are gated.
     */
    strategy: AttestationStrategy);
    /** Register a collection's attestation field-schema (from `vault.collection`). */
    register(collection: string, schema: AttestationFieldSchema): void;
    issue(collectionName: string, id: string): Promise<{
        docId: string;
        qr: string;
        keyId: string;
        publicKeyB64: string;
    }>;
    getDocumentSigningPublicKey(): Promise<{
        keyId: string;
        publicKeyB64: string;
    }>;
    private makeIssueContext;
    revoke(docId: string): Promise<void>;
    unrevoke(docId: string): Promise<void>;
    getRevokedDocIds(): Promise<string[]>;
    publishRevocationList(): Promise<RevocationList>;
    private makeRevokeContext;
}