/**
 * Inbound credential verification.
 *
 * Uses kernel-core's credential verification infrastructure
 * (CredentialMethodResolver, MethodRegistry) instead of manual JWT handling.
 * Not tied to JWT — supports any credential method kernel-core provides.
 */
import type { Attestation, CredentialInput, Delegation, VerifiedCredential } from '@astrale-os/kernel-core';
import type { RemoteIdentityConfig } from './identity.js';
export type VerifiedInbound = {
    /** The full verified credential (iss, sub, aud, claims) */
    verified: VerifiedCredential;
    /** Issuer URL (from credential's iss claim) */
    issuer: string;
    /** Attestation — proves caller can invoke this function */
    attestation: Attestation;
    /** Delegation — scoped caller permissions as kernel-signed credential */
    delegation: Delegation;
};
/** Clear cached JWKS resolvers. Used in tests when keys rotate between fixtures. */
export declare function clearJwksCache(): void;
/**
 * Verify an inbound delegation credential using kernel-core's verification.
 *
 * @throws AuthenticationError subclasses from kernel-core on verification failure
 */
export declare function verifyInboundCredential(credential: CredentialInput, config: RemoteIdentityConfig): Promise<VerifiedInbound>;
//# sourceMappingURL=verify.d.ts.map