import type { Result } from '@private.me/shared';
/** Error codes for subscription proof operations. */
export type ProofError = 'INVALID_PROOF' | 'EXPIRED' | 'SIGNATURE_VERIFICATION_FAILED' | 'HASH_FAILED' | 'NETWORK_ERROR' | 'INVALID_DID';
/**
 * Subscription proof format (peer-signed).
 *
 * Enables gateway portability: clients can resume subscriptions on a new
 * gateway by presenting a proof that they previously subscribed to a bloom
 * filter covering specific DIDs.
 */
export interface SubscriptionProof {
    /** Proof type identifier. */
    readonly type: 'SubscriptionProof';
    /** Proof format version. */
    readonly version: '1.0';
    /** Subscriber's DID (did:key:z6Mk... or did:privateme:...). */
    readonly peer_did: string;
    /** SHA-256 hash of the bloom filter (hex string). */
    readonly bloom_filter_hash: string;
    /** Unix timestamp (ms) when proof was created. */
    readonly asserted_at: number;
    /** Unix timestamp (ms) when proof expires. */
    readonly expires_at: number;
    /** Signature algorithm used. */
    readonly peer_signature_algorithm: 'ML-DSA-65';
    /** Base64-encoded ML-DSA-65 signature (3309 bytes). */
    readonly peer_signature: string;
}
/**
 * Create a subscription proof (client-side).
 *
 * Signs a bloom filter hash with the peer's ML-DSA-65 private key, creating
 * a portable proof that can be used to resume subscriptions on a new gateway.
 *
 * @param peerDid - Subscriber's DID (must match the private key).
 * @param bloomFilterHash - SHA-256 hash of the bloom filter (hex string).
 * @param privateKey - 32-byte ML-DSA-65 secret key seed.
 * @param expiresAt - Optional expiration timestamp (ms). Default: 30 days from now.
 * @returns Subscription proof with ML-DSA-65 signature.
 *
 * @example
 * ```typescript
 * const proof = await createSubscriptionProof(
 *   'did:key:z6Mk...',
 *   'a1b2c3...',
 *   mlDsaPrivateKey,
 *   Date.now() + 30 * 24 * 60 * 60 * 1000
 * );
 * ```
 */
export declare function createSubscriptionProof(peerDid: string, bloomFilterHash: string, privateKey: Uint8Array, expiresAt?: number): Promise<Result<SubscriptionProof, ProofError>>;
/**
 * Verify a subscription proof (gateway-side).
 *
 * Validates the ML-DSA-65 signature and checks expiration.
 *
 * @param proof - Subscription proof to verify.
 * @param peerPublicKey - 1952-byte ML-DSA-65 public key of the subscriber.
 * @returns true if valid, false if invalid or expired.
 *
 * @example
 * ```typescript
 * const isValid = await verifySubscriptionProof(proof, mlDsaPublicKey);
 * if (isValid.ok && isValid.value) {
 *   // Resume subscription
 * }
 * ```
 */
export declare function verifySubscriptionProof(proof: SubscriptionProof, peerPublicKey: Uint8Array): Promise<Result<boolean, ProofError>>;
/**
 * Resume subscription on a new gateway using a proof.
 *
 * Presents the subscription proof to the new gateway, allowing the client
 * to resume receiving trust events without re-subscribing.
 *
 * @param proof - Valid subscription proof.
 * @param newGatewayUrl - Base URL of the new gateway (e.g., https://atelier2.xail.io).
 * @returns Success or network error.
 *
 * @example
 * ```typescript
 * const result = await resumeSubscription(proof, 'https://atelier2.xail.io');
 * if (result.ok) {
 *   console.log('Subscription resumed on new gateway');
 * }
 * ```
 */
export declare function resumeSubscription(proof: SubscriptionProof, newGatewayUrl: string): Promise<Result<void, ProofError>>;
/**
 * Compute SHA-256 hash of a bloom filter for proof creation.
 *
 * @param bloomFilter - Bloom filter bytes.
 * @returns Hex-encoded SHA-256 hash.
 *
 * @example
 * ```typescript
 * const hash = await hashBloomFilter(bloomFilterBytes);
 * if (hash.ok) {
 *   const proof = await createSubscriptionProof(did, hash.value, privateKey);
 * }
 * ```
 */
export declare function hashBloomFilter(bloomFilter: Uint8Array): Promise<Result<string, ProofError>>;
