/**
 * `unilateralWithdrawal`: a non-owner extracts their accessible scope
 * AND disposes of the source copy. Destructive; gated by the default-off
 * fail-closed built-in `client-unilateral-withdraw` policy (checked in the
 * UserApi wrapper).
 *
 * Two source dispositions:
 *  - 'delete'  — delete-closure: the records leave the source vault entirely.
 *  - 'freeze'  — the firm retains a cryptographically-frozen, read-only, write-once
 *                snapshot (hash-pinned in the tamper-evident ledger) while the live
 *                records are removed.
 *
 * Ordering guarantees no data loss: the client's re-keyed export bundle (and the
 * freeze snapshot) are produced BEFORE anything is deleted.
 *
 * The `freezeAndDeleteClosure` core is shared with the two-party approval path
 * (`request-withdrawal.ts`).
 */
import type { Vault } from '../../kernel/vault.js';
export declare const FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
/** 24-hex-char random id (used for withdrawal ids + request ids). */
export declare function randomId(): string;
export interface FrozenSnapshotRef {
    readonly withdrawalId: string;
    readonly sha256: string;
    readonly recordCount: number;
    readonly frozenAt: string;
}
export interface WithdrawAccessibleOptions {
    /** Legal/contractual basis recorded in the audit (e.g. 'gdpr-art-17'). */
    readonly legalBasis: string;
    /** Re-key the exported bundle to a new owner passphrase. */
    readonly reKey?: {
        readonly passphrase: string;
    };
    /** Source disposition. Default 'delete'. */
    readonly disposition?: 'delete' | 'freeze';
    readonly scope?: {
        readonly collections?: readonly string[];
    };
    /** Stable id for idempotent resume (default random). */
    readonly withdrawalId?: string;
}
export interface WithdrawResult {
    readonly bundle: Uint8Array;
    readonly snapshot?: FrozenSnapshotRef;
}
/**
 * Freeze a write-once, hash-pinned snapshot of the current ciphertext for
 * `collections` WITHOUT touching the live records. Returns the snapshot ref.
 *
 * This is the non-destructive core shared by two callers:
 *  - `freezeAndDeleteClosure` (withdrawal, disposition `'freeze'`) — which
 *    pins the snapshot and THEN delete-closures the live records.
 *  - FR-6 `liberateVault` (custody) — which pins a PRE-liberation evidence
 *    snapshot but PRESERVES the live data for the new owner (operational
 *    continuity; liberation transfers, it does not erase).
 *
 * The snapshot put is write-once (CAS expectedVersion 0) and the ledger pin is
 * appended on success, so a crashed run re-run with the same `withdrawalId` is
 * safe. The snapshot is taken under the vault's own firm-owned DEKs — no re-key.
 */
export declare function freezeSnapshotOnly(vault: Vault, collections: readonly string[], opts: {
    actorUserId: string;
    withdrawalId?: string;
}): Promise<FrozenSnapshotRef>;
/**
 * Dispose of the source records for `collections`: optionally freeze a
 * write-once hash-pinned snapshot of the original ciphertext, then
 * delete-closure the live records. Returns the snapshot ref on freeze.
 *
 * Caller MUST have produced the portable bundle FIRST — this is destructive.
 * The delete is best-effort + idempotent (re-deleting an absent record is a
 * no-op) and the snapshot put is write-once (CAS expectedVersion 0), so a
 * crashed run re-run with the same `withdrawalId` is safe.
 */
export declare function freezeAndDeleteClosure(vault: Vault, collections: readonly string[], opts: {
    disposition: 'delete' | 'freeze';
    actorUserId: string;
    withdrawalId?: string;
}): Promise<FrozenSnapshotRef | undefined>;
export declare function withdrawAccessibleData(vault: Vault, opts: WithdrawAccessibleOptions): Promise<WithdrawResult>;