/**
 * Trust V1 record — runtime-backed value object.
 *
 * Validated at the adapter boundary via fromDecoded(). No Zod —
 * integrity is guaranteed by git-cas (SHA-256 chunks), recordId
 * (content-addressed hash), and Ed25519 signatures.
 *
 * The signaturePayload is precomputed by the adapter from the raw
 * canonical form, so domain code never touches untyped wire data.
 *
 * @module domain/trust/TrustRecord
 * @see docs/specs/TRUST_CRYPTO_ALGORITHM.md
 */
declare const RECORD_TYPES: readonly ["KEY_ADD", "KEY_REVOKE", "WRITER_BIND_ADD", "WRITER_BIND_REVOKE"];
type RecordType = typeof RECORD_TYPES[number];
type KeyAddSubject = {
    readonly keyId: string;
    readonly publicKey: string;
};
type KeyRevokeSubject = {
    readonly keyId: string;
    readonly reasonCode: string;
};
type WriterBindAddSubject = {
    readonly writerId: string;
    readonly keyId: string;
};
type WriterBindRevokeSubject = {
    readonly writerId: string;
    readonly keyId: string;
    readonly reasonCode: string;
};
type TrustSubject = KeyAddSubject | KeyRevokeSubject | WriterBindAddSubject | WriterBindRevokeSubject;
type TrustSignature = {
    readonly alg: 'ed25519';
    readonly sig: string;
};
type DecodedTrustRecord = {
    readonly schemaVersion: number;
    readonly recordType: string;
    readonly recordId: string;
    readonly issuerKeyId: string;
    readonly issuedAt: string;
    readonly prev: string | null;
    readonly subject: Readonly<Record<string, string>>;
    readonly meta: Readonly<Record<string, string | number | boolean | null>>;
    readonly signature: {
        readonly alg: string;
        readonly sig: string;
    };
    readonly signaturePayload: Uint8Array;
};
declare class TrustRecord {
    readonly schemaVersion: 1;
    readonly recordType: RecordType;
    readonly recordId: string;
    readonly issuerKeyId: string;
    readonly issuedAt: string;
    readonly prev: string | null;
    readonly subject: Readonly<TrustSubject>;
    readonly meta: Readonly<Record<string, string | number | boolean | null>>;
    readonly signature: Readonly<TrustSignature>;
    readonly signaturePayload: Uint8Array;
    private constructor();
    /**
     * Constructs a TrustRecord from adapter-decoded data.
     *
     * The adapter is responsible for:
     * 1. CBOR decoding the raw blob (via git-cas)
     * 2. Verifying recordId against the raw canonical hash
     * 3. Computing signaturePayload from the raw canonical form
     * 4. Passing the decoded + verified data here for structural validation
     *
     * Throws TrustError on invalid structure.
     */
    static fromDecoded(input: DecodedTrustRecord): TrustRecord;
    /** Type guard: is this a KEY_ADD record? */
    isKeyAdd(): this is TrustRecord & {
        readonly subject: KeyAddSubject;
        readonly recordType: 'KEY_ADD';
    };
    /** Type guard: is this a KEY_REVOKE record? */
    isKeyRevoke(): this is TrustRecord & {
        readonly subject: KeyRevokeSubject;
        readonly recordType: 'KEY_REVOKE';
    };
    /** Type guard: is this a WRITER_BIND_ADD record? */
    isBindAdd(): this is TrustRecord & {
        readonly subject: WriterBindAddSubject;
        readonly recordType: 'WRITER_BIND_ADD';
    };
    /** Type guard: is this a WRITER_BIND_REVOKE record? */
    isBindRevoke(): this is TrustRecord & {
        readonly subject: WriterBindRevokeSubject;
        readonly recordType: 'WRITER_BIND_REVOKE';
    };
}
export { TrustRecord, RECORD_TYPES };
export type { RecordType, KeyAddSubject, KeyRevokeSubject, WriterBindAddSubject, WriterBindRevokeSubject, TrustSubject, TrustSignature, DecodedTrustRecord, };
