/**
 * A locally-generated agent identity (an nkey user keypair).
 *
 * The public key is the **stable id** used identically everywhere — `card.id`, the
 * subject-encoded sender token, the JWT subject, and the DM durable name — so the
 * server's ACLs and the wire layout stay in lockstep. The seed is the private half:
 * it never goes on the wire and (from the provisioning step on) is signed into a
 * creds file the endpoint loads to authenticate as this id.
 */
export interface Identity {
    /** User nkey public key (`U…`). The stable agent id. */
    id: string;
    /** User nkey seed (`SU…`). Private — kept off the wire. */
    seed: string;
}
/** Generate a fresh user nkey identity locally. The seed is derived here and never
 *  leaves the generating process except as a creds file handed to its own agent. */
export declare function newIdentity(): Identity;
/** The signing half an authority-bearing artifact needs: `signArtifact` / `mintSessionGrant`
 *  take exactly `{ sign(input): Uint8Array }`, and the matching `publicKey` is what the
 *  verifying anchor pins. An nkey KeyPair already satisfies both; this narrows it to the
 *  artifact surface so a consumer that must not depend on `@nats-io/nkeys` directly (an
 *  `implementations/*` package) can still sign — core owns the signing primitive. */
export interface ArtifactSigner {
    /** The signer's nkey public key (`U…`) — the `SignerAnchor.publicKey` a verifier resolves. */
    publicKey: string;
    /** Ed25519 signature over an artifact's canonical signature input. */
    sign(input: Uint8Array): Uint8Array;
}
/** Build an artifact signer from an existing nkey seed (e.g. an endpoint's own key material).
 *  The seed never leaves the process; only signatures + the public key do. */
export declare function artifactSignerFromSeed(seed: string): ArtifactSigner;
/** A fresh artifact signer (its own keypair + seed): for a self-signing endpoint that mints its
 *  own session grants and registers the matching public key as its `sessions` trust anchor. */
export declare function newArtifactSigner(): ArtifactSigner & {
    seed: string;
};
/** The stable id carried by a creds file: the agent's nkey public key. Derived from the
 *  seed block (format-independent) and cross-checked against the JWT subject — a mismatch
 *  means a corrupt or spliced creds file (a seed paired with someone else's JWT), which
 *  would otherwise auth as one identity while the subject token claims another. Lets an
 *  endpoint that authenticates with creds adopt the matching `card.id`, keeping one id
 *  everywhere. */
export declare function idFromCreds(creds: string): string;
/** The compact USER JWT carried by a creds file — ONE extraction, shared by every reader that
 *  needs the token rather than the whole envelope. Returns undefined when there is no JWT block;
 *  callers decide whether that is fatal. */
export declare function jwtFromCreds(creds: string): string | undefined;
/** The ACCOUNT a creds file authenticates as.
 *
 *  `iss` is NOT the answer, and assuming it was is a live-verified mistake: when a user JWT is
 *  signed by an account SIGNING key (which every credential this repo mints is), `iss` carries the
 *  SIGNING key and the account identity lives in `nats.issuer_account`. Comparing `iss` to an
 *  account public key rejects every correctly-configured mesh. So: `nats.issuer_account` when
 *  present, falling back to `iss` for a JWT signed directly by the account identity key.
 *
 *  This exists so a process can cross-check its own tenancy against material it read off DISK.
 *  A daemon that resolves its scan target from a file (`membership.json`) has no way, without
 *  this, to notice it is reading a DIFFERENT tenant's file than the one it authenticates as — and
 *  a complete, well-formed sweep of the wrong account is indistinguishable from "the principal is
 *  gone". Fail-closed: no JWT block, or no usable `iss`, throws rather than returning a value a
 *  caller might compare loosely. */
export declare function accountFromCreds(creds: string): string;
/** A non-secret GENERATION token for a credential: SHA-256 of its compact USER JWT.
 *
 *  The JWT, not the whole creds envelope, on purpose. The JWT is exactly what the broker is
 *  presented with, so hashing it binds the claims, permissions, and signature of the generation
 *  being adopted. The envelope additionally carries the nkey SEED, so hashing that would put a
 *  stable secret-derived token on a control rail and make the value sensitive to envelope
 *  formatting, without proving anything more about broker authorization. The seed stays bound
 *  separately: {@link identityFromCreds} rejects a seed whose public key is not the JWT subject.
 *
 *  Safe to send on the privileged rail as an EXPECTED-generation token; the credential itself is
 *  never sent. Ephemeral by contract — it must not be persisted (see the renewal record). */
export declare function credsFingerprint(creds: string): string;
/** The `nats` claim block of a NATS user JWT — the permission set the broker enforces. Declared
 *  because a local reader sometimes needs to know what a cred is SCOPED TO, not just when it
 *  expires: an account-scoped cred names its own account inside `pub.allow`, which lets a holder
 *  check a credential against the tenant it believes it serves BEFORE connecting, and report a
 *  mismatch as a named refusal instead of a bare broker "Authorization Violation".
 *
 *  Read-only diagnosis, never enforcement: these claims are UNVERIFIED here (see
 *  {@link credsClaims}), and the broker enforces the same permissions independently. A local check
 *  over this block buys the DIAGNOSIS; it does not buy the guarantee. */
export interface NatsUserClaims {
    pub?: {
        allow?: string[];
        deny?: string[];
    };
    sub?: {
        allow?: string[];
        deny?: string[];
    };
    /** The account that ISSUED this user (for a data-account cred, the data account). */
    issuer_account?: string;
}
/** The decoded (UNVERIFIED) claims of a creds file's user JWT — shared parse for every local
 *  inspector (credential health, renewal scheduling, identity checks). Unverified is correct here:
 *  the broker is the enforcement boundary; local readers only need the claims to schedule and
 *  diagnose. Throws on a structurally-unusable file (no JWT block / undecodable payload).
 *
 *  `nats` was always PRESENT in the returned object (this is a whole-payload parse) but was not
 *  DECLARED, so a caller needing the permission block had to cast past this signature. Declaring it
 *  is a typing fix, not a behaviour change: no parse, no field and no error path moves. */
export declare function credsClaims(creds: string): {
    sub?: string;
    iat?: number;
    exp?: number;
    name?: string;
    iss?: string;
    nats?: NatsUserClaims;
};
/** Ms until a source-fed cred's RENEWAL point — 75% of its iat→exp lifetime (the cert-manager-style
 *  renew-early convention: the remaining 25% is the loud-failure window, wide for day-scale standing
 *  creds). Negative when already past it. A source-fed cred WITHOUT a numeric `exp` is fail-loud: the
 *  renewal seam exists precisely for bounded creds, so an unbounded one signals a matrix/caller
 *  mismatch, not a cred to keep silently forever. Shared by the endpoint's `delivery.creds` renewal
 *  and the membership feed's rw-cred renewal so the 75% convention is defined once. */
export declare function credsRenewalDelayMs(creds: string): number;
/** Combine a host-signed user JWT with a locally held matching user nkey seed. The seed never
 * crosses the authority protocol; this is the participant-side materialization step. */
export declare function credsFromJwt(jwt: string, identity: Identity): string;
/** The full identity (id + seed) carried by a creds file — what a standing-renewal REMINTER needs:
 *  re-signing a fresh JWT for the file's EXISTING nkey (never a new one) is what lets the renewed
 *  cred pass the endpoint's identity pin, so renewal can never silently swap who a daemon is. Same
 *  seed-block parse + JWT-subject cross-check as {@link idFromCreds}. */
export declare function identityFromCreds(creds: string): Identity;
//# sourceMappingURL=identity.d.ts.map