/**
 * Partition adoption. Recipient side: verify an extracted bundle,
 * validate the transfer key, import the re-keyed collections into a
 * destination store, and record an `_meta/adoption` marker. The bundle
 * stays UNOWNED after adoption — `createOwnerOnAdoptedPartition`
 * mints the owner; the transfer seal is then destroyed.
 *
 * @module
 */
import { type EnclaveKey } from '../kernel/enclave/index.js';
import type { NoydbStore } from '../kernel/types.js';
import type { SealingKeyProvider } from '../with-party/team/managed-passphrase.js';
import type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js';
import type { RecoveryEnrollmentInput } from '../with-party/team/rotate-recover.js';
import type { TransferSealPayload } from '../with-pod/bundle.js';
/**
 * Reverse of `sealDeks`. Imports the transfer key, decrypts the
 * sealed `{ collection: base64(rawDEK) }` map (layout iv(12)‖ct‖tag), and
 * re-imports each DEK as an AES-GCM key. Throws `TransferSealError` on a
 * wrong key (AES-GCM auth-tag failure) or malformed payload.
 */
export declare function unsealDeks(seal: TransferSealPayload, transferKey: Uint8Array): Promise<Map<string, EnclaveKey>>;
export interface AdoptPartitionOptions {
    readonly transferKey: Uint8Array;
    readonly destinationStore: NoydbStore;
    readonly vaultName: string;
}
export interface AdoptPartitionResult {
    readonly vaultName: string;
    readonly needsOwner: true;
    readonly sealId: string;
}
export declare function adoptPartition(bundleBytes: Uint8Array, opts: AdoptPartitionOptions): Promise<AdoptPartitionResult>;
export interface CreateOwnerResult {
    readonly vaultName: string;
    readonly userId: string;
}
/** Standard-mode owner: recipient supplies the passphrase. */
export interface CreateOwnerStandardOptions {
    readonly userId: string;
    readonly passphrase: string;
    readonly transferKey: Uint8Array;
}
/**
 * Managed-mode owner: the passphrase is minted + sealed under
 * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition
 * auto-unlocks on the recipient's device. Managed mode mandates a strong
 * (Shamir) recovery profile at creation, which needs the
 * `shamirRecovery` provider injected.
 */
export interface CreateOwnerManagedOptions {
    readonly userId: string;
    readonly passphraseMode: 'managed';
    readonly sealingKey: SealingKeyProvider;
    readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
    readonly shamirRecovery: ShamirRecoveryProvider;
    readonly transferKey: Uint8Array;
}
export type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManagedOptions;
/**
 * Mint the first owner keyring on an adopted-but-unowned partition,
 * then destroy the transfer seal.
 *
 * Standard mode: the recipient supplies a passphrase. Managed mode: the
 * passphrase is minted + sealed under a `SealingKeyProvider` and a strong
 * (Shamir) recovery profile is enrolled — orchestrated via the existing
 * `openVaultAndEnrollRecovery` ceremony.
 *
 * Either way, reuses `createOwnerKeyring` to derive the KEK + write the base
 * keyring, then wraps the partition's DEKs (recovered from the seal) under that
 * KEK and re-persists the merged keyring file.
 *
 * Idempotent under retry: the seal is destroyed LAST (Stage D), after the
 * keyring (Stage A), the ledger transition (Stage B), and — in managed mode —
 * strong-recovery enrollment (Stage C). A failure in the fallible enrollment
 * step leaves the seal intact, and re-running with the same `userId` +
 * `transferKey` resumes from the first incomplete stage. (Multi-profile recovery
 * arrays may re-enroll an already-enrolled profile on retry; managed mode's
 * mandated single Shamir profile does not.)
 */
export declare function createOwnerOnAdoptedPartition(store: NoydbStore, vaultName: string, opts: CreateOwnerOptions): Promise<CreateOwnerResult>;