import type { IVerifiableCredential, IVerifiablePresentation } from '@interop/data-integrity-core';
import { APP_KEY_CREDENTIAL_TYPE, APP_KEY_TYPE_ARRAY } from '@interop/wallet-core/request';
import { type IdentityAgents } from './agents.js';
import type { DocumentLoader } from './documentLoader.js';
/**
 * The pinned wire constants of the app-key credential, owned by
 * `@interop/wallet-core/request` (the wallet mints against the same values) and
 * re-exported here so an application reads them from one place:
 *
 * - `APP_KEY_CREDENTIAL_TYPE` -- the marker type every app key carries, mapped
 *   to one stable IRI for every app by the hosted App Connect context. It makes
 *   "presents as an app key" a term check rather than a shape heuristic, which
 *   is what lets the wallet refuse a foreign app key at store time. It is a
 *   self-declaration, not evidence: the `type` array of a planted credential is
 *   attacker-controlled like the rest of it. The marker makes the rule precise;
 *   the seed-to-DID binding `parseSeedCredential` enforces remains the only
 *   thing that authenticates.
 * - `APP_KEY_TYPE_ARRAY` -- the credential's fixed two-entry `type` array, in
 *   that order.
 */
export { APP_KEY_CREDENTIAL_TYPE, APP_KEY_TYPE_ARRAY };
/**
 * A parsed and structurally validated seed credential.
 */
export interface ParsedSeedCredential {
    seed: Uint8Array;
    controllerDid: string;
    /**
     * The identity agents derived from the embedded seed while checking the
     * seed-to-DID binding. Handed back so the login flow does not derive the same
     * master identity a second time (the derivation is the expensive step).
     */
    identity: IdentityAgents;
}
/**
 * Encodes bytes as base64url (no padding), browser- and Node-safe.
 */
export declare function bytesToBase64url(bytes: Uint8Array): string;
/**
 * Decodes base64url text back into bytes.
 */
export declare function base64urlToBytes(text: string): Uint8Array;
/**
 * Self-issues the app-key credential for `seed`, signed Ed25519Signature2020 by
 * the seed-derived signer.
 *
 * @param options {object}
 * @param options.seed {Uint8Array}   the 32-byte master seed
 * @param options.origin {string}     this app's web origin (anti-phishing bind)
 * @param options.appUrl {string}     this app's canonical URL, in its
 *   serialized form (see `serializedAppUrl`); identifies the application among
 *   the applications on its origin
 * @param options.appName {string}    human-readable app name, shown by the
 *   wallet on the credential (`name`/`description`)
 * @param options.documentLoader {DocumentLoader}
 * @returns {Promise<IVerifiableCredential>}
 */
export declare function issueSeedCredential({ seed, origin, appUrl, appName, documentLoader }: {
    seed: Uint8Array;
    origin: string;
    appUrl: string;
    appName: string;
    documentLoader: DocumentLoader;
}): Promise<IVerifiableCredential>;
/**
 * Parses an app-key credential and enforces the App Connect spec's six parse
 * checks, in order: the `AppKeyCredential` marker type, the `appUrl` claim
 * matching what this request sent (exact string), self-issue (issuer ===
 * subject id), the origin binding (exact string, against this app's own live
 * origin -- the same value it sent as the request `domain`), a well-formed
 * 32-byte base64url-no-pad seed, and -- the strongest check -- that the DID
 * derived from the embedded seed IS the credential's subject/issuer DID. (The
 * cryptographic proof on the credential is verified separately at the
 * presentation level.)
 *
 * These duplicate checks the wallet already made; that is the point. They are
 * defense in depth over an origin binding and an identity binding this app is
 * fully able to check itself.
 *
 * @param options {object}
 * @param options.credential {IVerifiableCredential}
 * @param options.origin {string}   this app's own live browser origin
 * @param options.appUrl {string}   the serialized `appUrl` this request sent
 * @returns {Promise<ParsedSeedCredential>}
 */
export declare function parseSeedCredential({ credential, origin, appUrl }: {
    credential: IVerifiableCredential;
    origin: string;
    appUrl: string;
}): Promise<ParsedSeedCredential>;
/**
 * Finds the app-key credential inside a wallet response VP, or `null` when the
 * wallet returned none (the wallet-unsupported signal).
 *
 * Matched on the `credentialSubject.appUrl` claim ALONE: per the App Connect
 * spec's response-verification step 3, the `AppKeyCredential` marker type must
 * NOT be required here. Requiring it would make "the wallet returned a
 * credential that is wrong" indistinguishable from "the wallet returned
 * nothing" -- a returned credential missing the marker must surface as a parse
 * error from {@link parseSeedCredential}, not as a `null` a caller would read
 * as first run and answer by silently minting a second key.
 *
 * @param options {object}
 * @param options.presentation {IVerifiablePresentation}
 * @param options.appUrl {string}   the serialized `appUrl` this request sent
 * @returns {IVerifiableCredential | null}
 */
export declare function findSeedCredential({ presentation, appUrl }: {
    presentation: IVerifiablePresentation;
    appUrl: string;
}): IVerifiableCredential | null;
//# sourceMappingURL=seedCredential.d.ts.map