/**
 * `liberateVault` — the audited claim of ownership over a
 * sealed-owner (Deed) vault. The inverse of withdrawal.
 *
 * A **Deed** vault's owner credential is sealed under a non-firm provider, so
 * the firm-side **custodian** (which holds every collection DEK and operates
 * the vault fully) can never reach `KEK_owner`. Liberation is the ONLY route
 * by which a custodian assumes ownership, and it is deliberately a manual,
 * audited ceremony:
 *
 *   1. gate `'liberate-vault'` (fail-closed)
 *   2. caller MUST be the `custodian` (the de-facto authority holding the DEKs)
 *   3. freeze a PRE-liberation EVIDENCE snapshot (hash-pinned in the ledger) —
 *      but PRESERVE the live data for the new owner (see the freeze decision
 *      below)
 *   4. mint a NEW owner keyring re-wrapping the incumbent DEKs under the new
 *      owner's KEK
 *   5. lifecycle ledger `liberation-claimed:<newOwnerId>:<legalBasis>`
 *   6. stamp the `_meta/deed` marker with `liberatedAt`
 *
 * ## Security: the inalienability floor
 *
 * Liberation **mints a new owner from the custodian's DEKs** — it does NOT
 * unseal the original sealed owner. The old sealed-owner credential is left
 * untouched and ORPHANED (its `_keyring/<id>` file remains, its KEK is still
 * sealed under the non-firm provider), never impersonated. The new owner is a
 * DISTINCT principal under a fresh KEK derived from `newOwnerPassphrase`. This
 * preserves the inalienability floor: the act of claiming ownership is itself
 * auditable and produces a different principal, rather than silently assuming
 * the latent owner's identity.
 *
 * ## Freeze decision: snapshot-only, not freeze-and-delete
 *
 * `freezeAndDeleteClosure` (withdraw-accessible.ts) writes a hash-pinned
 * snapshot and THEN delete-closures the live records — correct for a
 * destructive withdrawal, WRONG for liberation. Liberation transfers
 * operational continuity; it must leave the live data intact for the new
 * owner. We therefore call the snapshot-only core `freezeSnapshotOnly`
 * (factored out of that module; the freeze-AND-delete withdrawal path is
 * unchanged) to pin the evidence snapshot while preserving the records.
 *
 * @module
 */
import type { Vault } from '../../kernel/vault.js';
import type { FactorProofBundle } from '../../kernel/types.js';
import type { FrozenSnapshotRef } from '../../with-audit/portability/withdraw-accessible.js';
export interface LiberateOptions {
    /** The id of the new owner principal the custodian mints by claiming ownership. */
    readonly newOwnerId: string;
    /** The passphrase that derives the new owner's KEK (the DEKs are re-wrapped under it). */
    readonly newOwnerPassphrase: string;
    /** Legal/contractual basis recorded in the audit (e.g. 'contractual-handover'). */
    readonly legalBasis: string;
    readonly factors?: FactorProofBundle;
}
export interface LiberateResult {
    /** The hash-pinned pre-liberation evidence snapshot. */
    readonly snapshot: FrozenSnapshotRef;
}
/**
 * Audited claim of ownership over a sealed-owner vault by its custodian. See
 * the module doc for the full ceremony + security rationale.
 */
export declare function liberateVault(vault: Vault, opts: LiberateOptions): Promise<LiberateResult>;