import type { IVPRDetails } from './walletRequestTypes.js';
/**
 * The full WAS action vocabulary, in the order of the App Connect spec's
 * "Allowed actions" table -- also the allowed-action set of BOTH collection
 * classes, `https://w3id.org/byoe#private-collection` and
 * `https://w3id.org/byoe#public-collection`.
 */
export declare const RW_ACTIONS: string[];
/**
 * The actions requested on a SHARED (wallet-owned) collection: read-only, and
 * not configurable. A shared collection belongs to the wallet, so an app never
 * asks to write it.
 */
export declare const SHARED_ACTIONS: string[];
/**
 * The allowed actions of the descriptor class a collection is requested with
 * (the App Connect spec's "Allowed actions" table). Both collection classes --
 * public and private -- allow the full action vocabulary: published content is
 * still the application's own data, and un-publishing and revision are data
 * management like any other write, so an app may `PUT` or `DELETE` what it
 * published. Shares have their own fixed {@link SHARED_ACTIONS} and never
 * consult a configured action set.
 *
 * @param [_visibility] {'private' | 'public'}
 * @returns {string[]}
 */
export declare function actionCeiling(_visibility?: 'private' | 'public'): string[];
/**
 * One collection to request a grant for: the WAS collection id plus its
 * declared visibility (`'private'`, the default, or `'public'`).
 */
export interface GrantRequestCollection {
    /**
     * WAS collection id (the unprefixed, cross-app generic name).
     */
    id: string;
    /**
     * Who can read the collection; selects the descriptor type
     * (`https://w3id.org/byoe#private-collection` for `'private'`/unset,
     * `https://w3id.org/byoe#public-collection` for `'public'`).
     */
    visibility?: 'private' | 'public';
}
/**
 * A fresh nonce for a VPR challenge.
 */
export declare function newChallenge(): string;
/**
 * The one-popup App Connect VPR: DIDAuthentication + a single `AppConnectQuery`.
 *
 * The `app` block names the app -- `name` for the wallet's consent screen, and
 * `appUrl`, the application's canonical URL, which the wallet needs to MATCH an
 * existing app key or MINT a fresh one. The `appUrl` is validated and
 * serialized here against `domain` (this app's own live browser origin): it
 * must be an absolute, fragment-less, same-origin URL, and the serialization is
 * what everything downstream stores and compares. `capabilityQuery` holds one
 * collection-scoped grant request per app collection -- the existing capability
 * shape MINUS `controller` (the wallet fills it with the app-key subject DID)
 * and MINUS `reason` (the App Connect consent screen supersedes per-grant
 * reasons). A `visibility: 'public'` collection uses the
 * `https://w3id.org/byoe#public-collection` descriptor type; everything else
 * uses `https://w3id.org/byoe#private-collection`.
 *
 * @param options {object}
 * @param options.challenge {string}
 * @param options.domain {string}
 * @param options.appName {string}   human-readable app name for the consent
 *   screen
 * @param options.appUrl {string}   the application's canonical URL, same-origin
 *   with `domain` and fragment-less; emitted in its serialized form
 * @param options.collections {GrantRequestCollection[]}   the collections to
 *   request (WAS collection id + visibility)
 * @param [options.sharedCollections] {string[]}   WAS collection ids of
 *   wallet-owned collections to request read-and-decrypt access to; each gets
 *   a `https://w3id.org/byoe#shared-wallet-collection` descriptor with
 *   {@link SHARED_ACTIONS}
 * @param [options.actions] {string[]}   the action set to request on each app
 *   collection; when omitted each collection requests exactly its class's
 *   allowed actions ({@link actionCeiling}). An explicit set naming an action
 *   outside them throws (a configuration error, surfaced at build time rather
 *   than as a failed login)
 * @returns {IVPRDetails}
 */
export declare function buildAppConnectVpr({ challenge, domain, appName, appUrl, collections, sharedCollections, actions }: {
    challenge: string;
    domain: string;
    appName: string;
    appUrl: string;
    collections: GrantRequestCollection[];
    sharedCollections?: string[];
    actions?: string[];
}): IVPRDetails;
//# sourceMappingURL=loginRequest.d.ts.map