import { type KdfParams, SecretBuffer } from '../crypto/index.js';
import { type PolicyMode } from '../policy/index.js';
import type { SigilPaths } from './paths.js';
export interface PortalAddOpts {
    handle: string;
    keyFile: string;
    passphrase: Buffer;
    /**
     * If true, the source key file is deleted after successful encryption.
     * Defaults to true — leaving plaintext keys lying around is the whole
     * thing sigil is trying to prevent.
     */
    removeSource?: boolean;
    /**
     * Override KDF parameters. Production code path uses DEFAULT_KDF_PARAMS
     * (64MiB / 3 iters / 4 parallelism). Tests pass weaker params to keep
     * the suite fast. The CLI binary never sets this.
     */
    kdfParams?: KdfParams;
    /**
     * Policy template to write at provisioning time. Defaults to "permissive"
     * (signs anything the agent asks — same UX as today, key still protected
     * from context). Pass "strict" to write a locked-down template the user
     * must edit before signing succeeds.
     */
    policyMode?: PolicyMode;
}
/**
 * Reads a private key from disk, encrypts it with the passphrase, writes it
 * to the keys directory under <handle>.sigil, and (by default) deletes the
 * source file. Returns the derived address.
 *
 * Accepts the key file as either:
 *  - 32 raw bytes (binary)
 *  - 64 hex characters (optionally 0x-prefixed, optionally with trailing whitespace)
 */
export declare function portalAdd(paths: SigilPaths, opts: PortalAddOpts): {
    address: string;
    keyfilePath: string;
    policyPath: string;
};
export interface PortalNewOpts {
    handle: string;
    passphrase: Buffer;
    /** See PortalAddOpts.kdfParams — same test-only knob. */
    kdfParams?: KdfParams;
    /** See PortalAddOpts.policyMode. */
    policyMode?: PolicyMode;
}
/**
 * Mint a fresh secp256k1 key inside sigil, encrypt with the passphrase,
 * write the keyfile + policy file. No plaintext key ever lands on disk.
 * The randomness goes through @noble's randomSecretKey() which is uniform
 * over the valid scalar range.
 */
export declare function portalNew(paths: SigilPaths, opts: PortalNewOpts): {
    address: string;
    keyfilePath: string;
    policyPath: string;
};
export interface PortalInfo {
    handle: string;
    kind: 'evm';
    /** EVM address (secp256k1). */
    address: string;
    /** Solana address (ed25519) derived from the same secret. */
    svmAddress: string;
}
/**
 * Lists portals by reading the keys directory and decrypting each keyfile
 * just long enough to derive the address. Requires the passphrase.
 * Returns an empty list if the directory doesn't exist.
 */
export declare function portalListFromDisk(paths: SigilPaths, passphrase: Buffer): PortalInfo[];
/**
 * Resolve a single portal's address by decrypting its keyfile, deriving
 * the address, then disposing the secret. Throws if the handle is malformed
 * or the keyfile is missing / can't be decrypted with this passphrase.
 *
 * Used by `sigil portal qr` — same trust model as `portal list`, just
 * scoped to one handle so we don't decrypt the whole keychain to render
 * a single QR.
 */
export declare function portalAddress(paths: SigilPaths, handle: string, passphrase: Buffer): string;
export interface PortalRemoveResult {
    removed: boolean;
    path: string;
}
/**
 * Provision a policy file for an existing portal whose keyfile is on disk
 * but whose policy got lost (older sigil versions, manual deletion, etc).
 * Refuses to overwrite an existing policy — that's what the file is for.
 * Refuses to create one for a non-existent portal — fail loud.
 */
export declare function policyInit(paths: SigilPaths, handle: string, mode: PolicyMode): {
    policyPath: string;
    mode: PolicyMode;
};
export declare function portalRemove(paths: SigilPaths, handle: string): PortalRemoveResult;
export { SecretBuffer };
//# sourceMappingURL=portal.d.ts.map