/**
 * Identity Assertion Fragment Parsing
 *
 * Part of the consent-approve auth-gate fix
 * (docs/superpowers/specs/2026-07-29-consent-approve-auth-gate-design.md §3.1).
 * After credential/OAuth sign-in, the worker mints a grant-bound signed
 * identity assertion and redirects the browser to the clickwrap consent
 * screen carrying it in the URL **fragment**
 * (`.../consent#identity_assertion=<token>`) rather than a query param.
 * Fragments are never sent to the server — not in access logs, not in
 * `Referer` — so this is the only way the assertion can be delivered without
 * leaking it. That also means the server-rendered shell can never see it to
 * pass it down as an attribute; the component must read `location.hash`
 * itself once mounted in the browser.
 *
 * This module holds the pure parsing logic so it can be unit-tested in this
 * package's node-environment vitest suite, which has no DOM and cannot mount
 * the Lit component to exercise `location.hash` directly.
 *
 * @module @kya-os/consent/security/identity-assertion
 */
/**
 * Parse the `identity_assertion` value out of a URL fragment.
 *
 * Accepts a raw `location.hash`-shaped string, with or without its leading
 * `#`. Returns `undefined` when the key is absent, the value is empty, or
 * the fragment is empty/nullish. Never throws.
 *
 * @param hash - The fragment string, e.g. `location.hash`
 *   (`"#identity_assertion=abc"`)
 * @returns The decoded assertion token, or `undefined` if not present
 *
 * @example
 * ```typescript
 * parseIdentityAssertionFromHash('#identity_assertion=abc123')
 * // => 'abc123'
 *
 * parseIdentityAssertionFromHash('#a=1&identity_assertion=abc&b=2')
 * // => 'abc'
 *
 * parseIdentityAssertionFromHash('#a=1&b=2')
 * // => undefined
 *
 * parseIdentityAssertionFromHash('')
 * // => undefined
 * ```
 */
export declare function parseIdentityAssertionFromHash(hash: string | undefined | null): string | undefined;
//# sourceMappingURL=identity-assertion.d.ts.map