/**
 * Domain authority — the worker-side mint seam for identities THIS DOMAIN issues.
 *
 * A domain worker is a trusted issuer: the kernel resolves any `(iss, sub)`
 * credential signed with the worker's key back to the graph node carrying that
 * identity. That makes the worker the natural authority for the principals it
 * materializes — an App identity a workspace installs, a per-domain role
 * umbrella, a managed user. `mint` signs such a credential (optionally carrying
 * a `grant` claim with an unresolved identity expression); `sessionFor` opens a
 * kernel session presenting it, so the worker can ACT AS an identity it issues
 * (e.g. call `@<role>::mintDelegationCredential` as the role to obtain a
 * kernel-issued delegation inner).
 *
 * Scope guard: this signs under the WORKER'S OWN issuer only — it cannot forge
 * another issuer's identities. The kernel still enforces everything downstream
 * (trust of the issuer, `frozen`, grant resolution, nested-credential rules).
 */
import type { FnMap } from '@astrale-os/kernel-client';
import type { BoundClientSessionView } from '@astrale-os/kernel-client/session';
import type { UnresolvedIdentityExpr } from '@astrale-os/kernel-core';
import type { RemoteIdentityConfig } from './identity.js';
export type DomainAuthorityRef = {
    /** The issuer ID (used as the `iss` claim in credentials and on Identity nodes). */
    readonly iss: string;
};
export type MintIssuedParams = {
    /** The issued identity's `sub` — must match the graph node's stored subject. */
    subject: string;
    /** The credential's audience — the kernel (or worker) it will be presented to. */
    audience: string;
    /**
     * Optional `grant` claim: the identity expression the credential's holder may
     * act as (wrapped `{v:1, expr}`). Omit for a plain self-authenticating
     * credential — the kernel falls back to a self-grant for externally-issued
     * credentials. Nested `credential` leaves MUST be kernel-issued delegation
     * inners (the kernel refuses non-kernel nested credentials).
     */
    grant?: UnresolvedIdentityExpr;
    /** JWT lifetime, jose-style (`'60s'`, `'5m'`, `'1h'`). Default `'1h'`. */
    ttl?: string;
};
export type DomainAuthority = DomainAuthorityRef & {
    /** Sign a credential AS an identity this domain issues. */
    mint(params: MintIssuedParams): Promise<string>;
    /**
     * A kernel session presenting a pre-signed credential (typically from
     * {@link DomainAuthority.mint} with `audience = kernelUrl`).
     */
    sessionFor(kernelUrl: string, credential: string): BoundClientSessionView<FnMap>;
};
/** Build the domain authority for one worker identity config. */
export declare function makeDomainAuthority(identity: RemoteIdentityConfig): DomainAuthority;
//# sourceMappingURL=issuer-mint.d.ts.map