/**
 * "Add to Google Wallet" — a link, and the token inside it.
 *
 * The whole of Google's install flow: a JWT signed by the service account,
 * carrying the object to be saved, appended to a Google URL. The holder opens
 * it, Google reads the token, and the card is theirs. There is no upload and no
 * file.
 *
 * Which means the token **is** the credential. Anyone holding the link can save
 * the card, so it is generated per enrolment, never logged, and never put
 * anywhere it can be seen by somebody other than the person enrolling.
 */
/** Where a save link points. Google's, and not configurable. */
export declare const SAVE_URL = "https://pay.google.com/gp/v/save/";
export interface SaveLinkInput {
    /** The service account's email address, which is the token's issuer. */
    serviceAccountEmail: string;
    /** Its private key, PEM. */
    privateKey: Buffer | string;
    /**
     * The sites allowed to open this link.
     *
     * Google checks the referrer against these, so a token issued for the wrong
     * origin fails at Google with an error the person enrolling cannot act on.
     * Required in practice even though the API treats it as optional.
     */
    origins: readonly string[];
    /** The object as {@link buildLoyaltyObject} produced it. */
    loyaltyObject?: Record<string, unknown>;
    /** The class, when it is created by the same token rather than beforehand. */
    loyaltyClass?: Record<string, unknown>;
    /**
     * The ticket, as {@link buildEventTicketObject} produced it.
     *
     * Google keys the token's payload by what kind of pass it holds, so a ticket
     * sent as `loyaltyObjects` installs as a loyalty card with a balance where
     * its seat should be. One of this and `loyaltyObject` is required; both
     * together is a token that saves two passes and is almost certainly a
     * mistake, so it is refused.
     */
    eventTicketObject?: Record<string, unknown>;
    eventTicketClass?: Record<string, unknown>;
    /** The moment the token says it was issued. */
    now: Date;
}
/** The signed token. {@link saveLink} is usually what a caller wants instead. */
export declare function buildSaveToken(input: SaveLinkInput): string;
/**
 * The URL to put behind "Add to Google Wallet".
 *
 * Long — the object travels inside it — and that is Google's design rather than
 * a mistake. It is well inside what browsers and Android accept, but it is not
 * something to put in an SMS, which is why the desktop fallback in project 06
 * sends a short link to a page that renders this button rather than the link
 * itself.
 */
export declare const saveLink: (input: SaveLinkInput) => string;
//# sourceMappingURL=save-link.d.ts.map