/**
 * Transparent migration dual-read (DEC-116).
 *
 * After the identity fix, an agent's perennial inbox lives under its new
 * uuid-bearing instance id, while messages addressed before the migration sit
 * under the old label-derived instance dir(s). Migration must be transparent
 * and immediate: the agent keeps receiving everything with no manual move. The
 * read path therefore unions the current inbox with one or more legacy inbox
 * locations, deduplicated by envelope id — equivalent to reading several dirs
 * as if they were one (same id-sorted order as the single-dir reader).
 *
 * Pure + total: the impure part (which dirs to read) belongs to the caller; this
 * is the deterministic merge that is unit-tested in isolation.
 */
import type { H2AEnvelope } from "@sentropic/h2a";
/**
 * Merge envelope sets, deduplicated by `envelope.id`. Pass the CURRENT inbox
 * first: on an id collision the earlier set wins (identical content is expected,
 * but precedence is defined). Entries without a string `id` are skipped. The
 * result is sorted by `id` ascending, matching the single-dir reader's
 * filename `.sort()`, so a dual-read is indistinguishable from one merged dir.
 */
export declare function mergeInboxDedup(sets: ReadonlyArray<readonly H2AEnvelope[]>): H2AEnvelope[];
export interface LegacyAdoptionInput {
    /** Has some agent already inherited this legacy id's keyring (single-inheritor lock)? */
    readonly legacyAlreadyAdopted: boolean;
    /** Did this connector prove possession of one of the legacy keyring's keys? */
    readonly provedLegacyPossession: boolean;
}
export interface LegacyAdoptionDecision {
    /** Adopt the legacy id as an alias of this agent's perennial uuid + inherit its keyring. */
    readonly adopt: boolean;
    /** Mint a fresh key for this agent (honest re-key for de-collided peers). */
    readonly netNewKeys: boolean;
    readonly reason: string;
}
/**
 * Ratified migration rule (DEC-116, spec §Migration F4): the FIRST agent to
 * prove possession of a legacy key inherits the legacy keyring and adopts the
 * legacy id as an alias of its new perennial uuid; every de-collided peer mints
 * **net-new keys** (honest re-key, surfaced in the migration notice). No proof
 * → no inheritance. Pure + total. The adoption record + keyring copy are the
 * caller's (impure, locked) job; this is the deterministic decision.
 */
export declare function decideLegacyAdoption(input: LegacyAdoptionInput): LegacyAdoptionDecision;
export interface H2AIdentityAlias {
    readonly instance: string;
    readonly legacyInstance: string;
    readonly adoptedKeyring: boolean;
    readonly at: string;
}
export declare function listIdentityAliases(root: string, instance?: string): H2AIdentityAlias[];
export declare function legacyAliasAlreadyAdopted(root: string, legacyInstance: string): boolean;
export declare function recordIdentityAlias(root: string, alias: H2AIdentityAlias): void;
//# sourceMappingURL=migration.d.ts.map