import { type ActionInput } from '@interop/was-client';
import type { IDelegatedZcap } from '@interop/data-integrity-core';
/**
 * A fixed, distinct default provisioner seed -- the "wallet" that owns the dev
 * Space. Kept separate from the app seed (the relying party) so the delegation
 * is a genuine cross-identity grant, exactly as in the real wallet-to-RP flow.
 */
export declare const DEFAULT_PROVISIONER_SEED: Uint8Array;
/**
 * The outcome of a provisioning run: the signed grants plus the topology and
 * identities they were minted against. The JSON written to `outFile` (when
 * given) is `{ grants }`.
 */
export interface ProvisionDevGrantsResult {
    /**
     * One delegated read/write zcap per requested collection.
     */
    grants: IDelegatedZcap[];
    /**
     * The created space id.
     */
    spaceId: string;
    /**
     * The absolute space URL (`<serverUrl>/space/<spaceId>`).
     */
    spaceUrl: string;
    /**
     * The app (relying party) controller DID the grants were delegated to.
     */
    appDid: string;
    /**
     * The throwaway provisioner (space owner) DID.
     */
    provisionerDid: string;
    /**
     * Present only when `probe` was requested: the result of PUTting the
     * collection description (read first, written back verbatim) with the app's
     * delegated RW zcap.
     */
    probe?: {
        authorized: boolean;
        status?: number;
        body?: unknown;
    };
}
/**
 * Provisions a dev Space, its collections, and per-collection RW zcaps delegated
 * to the app DID derived from `seed`.
 *
 * @param options {object}
 * @param options.serverUrl {string}   base URL of a running was-teaching-server
 * @param options.seed {Uint8Array}   the app (relying party) master seed; the
 *   app DID the grants are delegated to is derived from it
 * @param options.collections {Array<string | object>}   the WAS collections to
 *   create and grant: a bare id string (private by default) or
 *   `{ id, visibility, blindedIndex }`. A private collection is declared `edv`
 *   and gets its epoch[0] roster (sole recipient: the app's identity
 *   key-agreement key); a public one stays plaintext. `blindedIndex: true`
 *   additionally installs the collection's blinded-index key with that first
 *   epoch, which is the only moment it can be installed; it is ignored with a
 *   warning on a public collection, which is plaintext and needs no blinding
 * @param [options.spaceName] {string}   human-readable Space name (defaults to
 *   `'Dev Space'`)
 * @param [options.outFile] {string}   when given, the `{ grants }` JSON is
 *   written here (parent directories are created)
 * @param [options.provisionerSeed] {Uint8Array}   the space-owner seed (defaults
 *   to `DEFAULT_PROVISIONER_SEED`)
 * @param [options.identityHandle] {string}   cosmetic label for the app identity
 *   agent; does not affect the derived DID
 * @param [options.actions] {ActionInput[]}   the RW action set delegated per
 *   collection (defaults to the auth layer's `RW_ACTIONS`)
 * @param [options.probe] {boolean}   when true, probe whether the delegated RW
 *   zcap authorizes a PUT of the collection description (read first and written
 *   back verbatim, so an installed epoch roster is never clobbered)
 * @param [options.log] {(message: string) => void}   progress sink (defaults to
 *   a no-op; the CLI passes `console.log`)
 * @returns {Promise<ProvisionDevGrantsResult>}
 */
export declare function provisionDevGrants({ serverUrl, seed, collections, spaceName, outFile, provisionerSeed, identityHandle, actions, probe, log }: {
    serverUrl: string;
    seed: Uint8Array;
    collections: Array<string | {
        id: string;
        visibility?: 'private' | 'public';
        blindedIndex?: boolean;
    }>;
    spaceName?: string;
    outFile?: string;
    provisionerSeed?: Uint8Array;
    identityHandle?: string;
    actions?: ActionInput[];
    probe?: boolean;
    log?: (message: string) => void;
}): Promise<ProvisionDevGrantsResult>;
//# sourceMappingURL=provisionDevGrants.d.ts.map