import { type VerifyTokenHook } from '@kokuin/capability';
import { type DIDMethodResolver } from '@kokuin/token';
import { type CredentialAuthority, type CredentialAuthorityParams } from '@kubun/credential';
export type ControllerAuthorityParams = {
    /** The device making the request; the capability holder and the read/self-owner subject. */
    viewerDID: string;
    /**
     * Intended owner for a NEW key. Under a real delegation this is the controller
     * the device acts for, supplied by the caller because it is neither the client's
     * input nor the signer but what the chain resolves to; defaults to a self-owned key.
     */
    ownerDID?: string;
    delegationTokens?: Array<string>;
    /** Injected so a `did:kokuin:` owner's capability and deny set resolve without a dependency cycle. */
    controllerResolver?: DIDMethodResolver;
    /** Device membership tokens held locally, independent of the request's capability chain. */
    heldControllerTokens?: (viewerDID: string) => Promise<Array<{
        grantor: string;
        token: string;
    }>>;
    /** The delegation-revocation hook, consulted for every capability in the chain. */
    revocationChecker?: VerifyTokenHook;
    /** Evaluate capability expiry at this time (epoch seconds) rather than now(). */
    atTime?: number;
};
/**
 * A superset of {@link createDeviceAuthority}: same owner-equality and wrapping-recipient
 * read, plus a capability chain that lets a delegate administer a controller-owned key on
 * its owner's behalf. `administer` alone carries the chain — a recipient already holds a
 * wrapping that decrypts, so `read` needs no delegation.
 */
export declare function createControllerAuthority(params: ControllerAuthorityParams): CredentialAuthority & {
    authorizeRevocation(params: CredentialAuthorityParams): Promise<boolean>;
};