import * as CRYPTO from 'node:crypto';
/** A content identifier: CIDv1, sha-256, over DAG-CBOR or raw bytes. */
export declare class CID {
    readonly bytes: Buffer;
    readonly codec: number;
    readonly digest: Buffer;
    private constructor();
    /** Parse a binary CID from the start of `bytes`; returns it and its length. */
    static read(bytes: Uint8Array, offset?: number): [CID, number];
    static decode(bytes: Uint8Array): CID;
    /** The `b…` base32 string form a PDS prints. */
    static parse(text: string): CID;
    /** The CID of `bytes` as a DAG-CBOR block. */
    static of(bytes: Uint8Array, codec?: number): CID;
    /** Whether `bytes` are the block this CID names. */
    matches(bytes: Uint8Array): boolean;
    equals(other: CID | null | undefined): boolean;
    toString(): string;
    toJSON(): {
        $link: string;
    };
}
/** What DAG-CBOR decodes to here. */
export type Value = null | boolean | number | string | Uint8Array | CID | Value[] | {
    [key: string]: Value;
};
/** Decode one DAG-CBOR value that must occupy all of `bytes`. */
export declare function decode(bytes: Uint8Array): Value;
/** Decode one DAG-CBOR value from the start of `bytes`; returns it and where it ends. */
export declare function decodeFirst(bytes: Uint8Array): [Value, number];
/**
 * Encode a value as canonical DAG-CBOR: shortest-form lengths, map keys sorted
 * by length and then bytewise, no floats. Used to rebuild the unsigned commit a
 * signature covers, and to build test fixtures.
 */
export declare function encode(value: Value | undefined): Buffer;
/** A CAR v1 file: its roots, and every block in it, each checked against its CID. */
export interface Car {
    roots: CID[];
    blocks: Map<string, Buffer>;
}
/**
 * Read a CAR v1 file. Every block is hashed and compared with the CID it is
 * filed under as it is read, so what comes back can be trusted to *be* the
 * blocks those CIDs name — whatever delivered the file.
 */
export declare function readCar(bytes: Uint8Array): Car;
/** Write a CAR v1 file — for tests, and for anything that wants to re-serve a proof. */
export declare function writeCar(roots: CID[], blocks: Iterable<[CID, Uint8Array]>): Buffer;
/** The curves atproto signs with. */
export type Curve = 'secp256k1' | 'P-256';
/** A verifying key, with the curve it is on. */
export interface PublicKey {
    curve: Curve;
    key: CRYPTO.KeyObject;
}
/**
 * The key a `publicKeyMultibase` names. `Multikey` values carry a multicodec
 * prefix saying which curve; the two older verification-method types name the
 * curve in the type instead and carry the bare compressed point.
 */
export declare function parseMultikey(multibase: string, type?: string): PublicKey;
/** A key object from a compressed (or uncompressed) EC point. */
export declare function pointKey(curve: Curve, point: Uint8Array): CRYPTO.KeyObject;
/** The compressed point of a public key, for building `publicKeyMultibase` values. */
export declare function compressedPoint(key: CRYPTO.KeyObject): Buffer;
/** `publicKeyMultibase` for a key, as a `Multikey` — the inverse of `parseMultikey`. */
export declare function formatMultikey(curve: Curve, key: CRYPTO.KeyObject): string;
/** Check a 64-byte compact, low-S ECDSA signature over sha-256 of `data`. */
export declare function verifySignature(key: PublicKey, data: Uint8Array, signature: Uint8Array): boolean;
/** Sign the way a PDS signs a commit: compact, low-S. For tests and fixtures. */
export declare function sign(curve: Curve, privateKey: CRYPTO.KeyObject, data: Uint8Array): Buffer;
/** What a DID document says that matters here. */
export interface DidDocument {
    id: string;
    alsoKnownAs?: string[] | undefined;
    verificationMethod?: {
        id: string;
        type: string;
        controller?: string;
        publicKeyMultibase?: string;
    }[] | undefined;
    service?: {
        id: string;
        type: string;
        serviceEndpoint: string | Record<string, unknown>;
    }[] | undefined;
}
/** The repository signing key a DID document publishes, as `#atproto`. */
export declare function signingKey(doc: DidDocument): PublicKey;
/** The PDS a DID document names, as `#atproto_pds`. */
export declare function pdsEndpoint(doc: DidDocument): string;
/** The handle a DID document claims, if any — for display; it proves nothing. */
export declare function claimedHandle(doc: DidDocument): string | undefined;
/** What a verified record proof establishes. */
export interface RecordProof {
    did: string;
    /** The repository revision the commit is at. */
    rev: string;
    /** The commit the proof is anchored in. */
    commit: CID;
    /** The record, or null when the proof shows there is none at that key. */
    record: {
        cid: CID;
        value: Value;
    } | null;
}
/**
 * Check a `com.atproto.sync.getRecord` CAR against the repository key of `did`,
 * and return what it proves about `collection/rkey`. Throws if the proof does
 * not hold together; returns `record: null` for a valid proof of absence.
 */
export declare function verifyRecordProof(car: Uint8Array | Car, { did, key, collection, rkey }: {
    did: string;
    key: PublicKey;
    collection: string;
    rkey: string;
}): RecordProof;
/**
 * One step of the walk to `key` through a Merkle Search Tree node: the record
 * the key maps to, when this node holds it, or the subtree to go on into —
 * null when there is none, which proves the key is not in the tree. What a
 * walk that fetches nodes as it goes takes one level at a time.
 */
export declare function treeStep(node: Uint8Array, key: Uint8Array): {
    record: CID;
} | {
    next: CID | null;
};
//# sourceMappingURL=repo.d.ts.map