/**
 * Coinbase x402 Adapter
 *
 * Rides alongside the standard `PAYMENT-REQUIRED` envelope: the server emits a
 * 402 with a fresh `Bolyra-Challenge` nonce, the agent returns a
 * `Bolyra-Credential` carrying a mutual ZK handshake proof bound to that
 * nonce, and the server verifies the proof off-chain before letting the call
 * through.
 *
 * Wire format (base64url(JSON)):
 *   {
 *     v: 1,
 *     did, sessionNonce (hex), scopeCommitment (decimal),
 *     scopeBitmask (decimal),
 *     humanProof, agentProof,                 // Groth16 proofs
 *     spendPolicy: { maxTransactionAmount, currency }
 *   }
 *
 * The merchant never sees the human's identity, the exact policy graph, or
 * any delegation chain — only that `verifyHandshake` cleared against the
 * server's challenge.
 */
import type { HumanIdentity, AgentCredential, BolyraConfig } from '@bolyra/sdk';
import type { PaymentTrustGrade, SpendPolicy } from './types';
/** Standard x402 envelope header carrying the `PAYMENT-REQUIRED` accepts list. */
export declare const X402_PAYMENT_REQUIRED_HEADER = "PAYMENT-REQUIRED";
/** Server → client: fresh single-use challenge nonce for this 402 round-trip. */
export declare const X402_BOLYRA_CHALLENGE_HEADER = "Bolyra-Challenge";
/** Client → server: base64url-encoded ZK credential bound to the challenge. */
export declare const X402_BOLYRA_CREDENTIAL_HEADER = "Bolyra-Credential";
/** Bolyra wire format version embedded in the credential. */
export declare const X402_WIRE_VERSION: 1;
/**
 * Minimal x402 payment requirements the merchant advertises in the 402
 * response. Matches the Coinbase x402 `accepts` envelope; Bolyra binds its
 * authorization to this exact requirements blob.
 */
export interface X402PaymentRequirements {
    /** CAIP-2 chain ID (e.g. `eip155:84532` for Base Sepolia). */
    chain: string;
    /** Asset symbol (e.g. `USDC`). */
    asset: string;
    /** Amount in minor units (e.g. cents). */
    amount: number;
    /** Recipient address. */
    recipient: string;
    /** Optional Merchant Category Code. */
    mcc?: string;
}
/** Result of `createX402Authorization`. */
export interface X402AuthorizationResult {
    /** Always true on the client side — server-side `verifyX402Authorization` is the source of truth. */
    verified: boolean;
    /** Self-asserted trust score (0–100). */
    score: number;
    /** Letter grade derived from score. */
    grade: PaymentTrustGrade;
    /** `did:bolyra:<network>:<commitment>` for the acting agent. */
    did: string;
    /** Headers to attach to the retry request. */
    headers: Record<string, string>;
    /** Session nonce the proof was bound to. */
    sessionNonce: bigint;
}
/** Result of `verifyX402Authorization`. */
export interface X402VerifyDecision {
    /** Whether the credential passed all gates (ZK + policy fit). */
    verified: boolean;
    /** Composite trust score (0–100). */
    score: number;
    /** Letter grade derived from score. */
    grade: PaymentTrustGrade;
    /** Acting agent DID from the credential. */
    did: string;
    /** Scope commitment from the handshake (root of the delegation chain). */
    scopeCommitment: bigint;
    /** Session nonce the credential committed to — caller MUST cross-check this against their nonce store. */
    sessionNonce: bigint;
    /** Soft signals (resolver miss, policy gaps, ZK errors) collected during verify. */
    warnings: string[];
    /** Whether the credential was resolved via the resolver. */
    credentialResolved: boolean;
    /** Currency/asset from the bundle's spend policy. */
    currency: string;
}
/**
 * Server-supplied lookup that maps a `did:bolyra:*` to the registered agent
 * credential, or `null` if unknown. Typically a DB read or cache hit.
 */
export type X402CredentialResolver = (did: string) => Promise<AgentCredential | null>;
/** Optional config — falls back to bundled vkeys + defaults. */
export interface X402Config {
    /** SDK config (circuit / vkey overrides). Defaults to bundled vkeys. */
    sdk?: BolyraConfig;
    /** Minimum score for `verified=true` (default: 70). */
    minScore?: number;
    /** Network label used in DID construction (default: `base-sepolia`). */
    network?: string;
}
/** Serialize an `X402PaymentRequirements` blob for the `PAYMENT-REQUIRED` header. */
export declare function serializePaymentRequired(reqs: X402PaymentRequirements): string;
/** Parse an `X402PaymentRequirements` blob from the `PAYMENT-REQUIRED` header. */
export declare function parsePaymentRequired(s: string): X402PaymentRequirements;
/**
 * Build an x402 authorization credential bound to the server's challenge nonce.
 *
 * Runs `proveHandshake` from `@bolyra/sdk` with `nonce: bolyraChallenge`, then
 * packs the resulting proofs + scope metadata into the `Bolyra-Credential`
 * header value (base64url-encoded JSON).
 *
 * Requires a Bolyra prover environment (circuit `.wasm` + `.zkey`). For
 * verification-only environments use the published vkeys; for proving you
 * need the full circuit artifacts (see `circuits/build/` in the monorepo
 * or pre-record proofs offline as `sdk/demo/generate-artifacts.js` does).
 */
export declare function createX402Authorization(human: HumanIdentity, agent: AgentCredential, spendPolicy: Pick<SpendPolicy, 'maxTransactionAmount' | 'currency'>, ctx: {
    requirements: X402PaymentRequirements;
    bolyraChallenge: bigint;
}, config?: X402Config): Promise<X402AuthorizationResult>;
/**
 * Verify an x402 Bolyra credential against payment requirements.
 *
 * Performs four gates and composes a 0–100 score:
 *   1. Wire decode + schema check       (rejection → grade F)
 *   2. ZK handshake verifies            (+60)
 *   3. `resolveCredential(did)` returns a credential (+20)
 *   4. Spend-policy fit: `requirements.amount ≤ scopeMaxTransactionAmount` (+20)
 *
 * The caller is responsible for replay protection (cross-checking
 * `sessionNonce` against their nonce store).
 */
export declare function verifyX402Authorization(credentialHeader: string, requirements: X402PaymentRequirements, resolveCredential: X402CredentialResolver, config?: X402Config): Promise<X402VerifyDecision>;