/**
 * Outbound Delegation Proof
 *
 * Builds signed delegation proof JWTs for injection on outbound HTTP requests.
 * Enables downstream services to independently verify the delegation chain
 * without trusting the MCP server.
 *
 * Wire format: signed compact EdDSA JWT (60s TTL, per-call jti)
 * Header injection: KYA-OS-Delegation-Chain, KYA-OS-Delegation-Proof, KYA-OS-Granted-Scopes,
 * and KYA-OS-Delegation-Credential (the JWS-compact DelegationCredential VC) when present
 *
 * Related Spec: DIF MCP-I §8 — Outbound Delegation Propagation
 */
import type { DelegationRecord } from "@kya-os/contracts/delegation";
/**
 * Ed25519 private key JWK (includes d for signing)
 */
export interface Ed25519PrivateJWK {
    kty: "OKP";
    crv: "Ed25519";
    /** Base64url-encoded public key scalar */
    x: string;
    /** Base64url-encoded private key scalar */
    d: string;
    kid?: string;
    use?: string;
}
/**
 * Options for building a delegation proof JWT
 */
export interface DelegationProofOptions {
    /** DID of the agent issuing the proof */
    agentDid: string;
    /** DID of the delegating user */
    userDid: string;
    /** Delegation VC credential ID */
    delegationId: string;
    /** Reference chain string (format: vc_id_1>del_id_1>...) */
    delegationChain: string;
    /** Scopes granted by the delegation */
    scopes: string[];
    /** Agent Ed25519 private key JWK (with d field) */
    privateKeyJwk: Ed25519PrivateJWK;
    /** Key ID for the JWT header (e.g. did:web:agent.example.com#key-1) */
    kid: string;
    /** Target service hostname (used as aud claim) */
    targetHostname: string;
}
/**
 * Build a signed delegation proof JWT.
 *
 * JWT is EdDSA-signed with the agent's Ed25519 key, 60s TTL, jti per call.
 * Returns the compact JWT string.
 *
 * @throws when the private key cannot be imported or signing fails
 */
export declare function buildDelegationProofJWT(options: DelegationProofOptions): Promise<string>;
/**
 * Build a delegation reference chain string.
 *
 * For a single delegation: "vcId>delegationId"
 * If vcId is absent: returns delegation.id
 * If both are absent: returns empty string
 *
 * For multi-hop chains, callers concatenate per-hop results with ">".
 *
 * @example
 *   buildChainString(del) // "vc_abc>del_123"
 */
export declare function buildChainString(delegation: DelegationRecord): string;
//# sourceMappingURL=outbound-proof.d.ts.map