/**
 * @module pom-verifier
 * @description Verifies Proof-of-Mandate (PoM) SD-JWT Verifiable Credentials.
 *
 * Supports:
 *   - `did:web` issuer DID resolution
 *   - SD-JWT compact form parsing
 *   - JWT signature verification (ECDSA P-256, RS256)
 *   - Standard claim validation (exp, iat, iss)
 *   - Selective disclosure extraction
 *
 * @example
 * ```ts
 * import { verifyProofOfMandate } from "@mandaitor/sdk";
 *
 * const result = await verifyProofOfMandate(pomCompact);
 * if (result.valid) {
 *   console.log(result.claims.decision); // "ALLOW"
 *   console.log(result.claims.mandate_id);
 * } else {
 *   console.error(result.errors);
 * }
 * ```
 */
import type { ProofOfMandateClaims } from "./types.js";
/** Outcome of verifying a Proof-of-Mandate: validity, decoded claims, disclosures, and any errors. */
export interface PomVerificationResult {
    /** Whether the PoM is valid */
    valid: boolean;
    /** Decoded PoM claims (available even if invalid, for inspection) */
    claims: Partial<ProofOfMandateClaims> | null;
    /** Extracted selective disclosures (base64url-decoded JSON arrays) */
    disclosures: PomDisclosure[];
    /** Validation errors (empty if valid) */
    errors: string[];
}
/** A single decoded SD-JWT selective disclosure (salt, claim name, and value). */
export interface PomDisclosure {
    /** Salt value */
    salt: string;
    /** Claim name */
    name: string;
    /** Claim value */
    value: unknown;
}
/** Options for {@link verifyProofOfMandate}: audience, clock skew, issuer allowlist, and a custom DID resolver. */
export interface PomVerifyOptions {
    /** Expected audience claim (optional) */
    audience?: string;
    /** Clock skew tolerance in seconds (default: 60) */
    clockSkewSeconds?: number;
    /** Custom DID document resolver (overrides default HTTP resolution) */
    didResolver?: (did: string) => Promise<DidDocument | null>;
    /** Current time override for testing (Unix seconds) */
    currentTime?: number;
    /**
     * Optional allowlist of acceptable issuer DIDs/URLs. When provided, the
     * credential's `iss` must be an EXACT member or the PoM is rejected before any
     * DID resolution (defence against SSRF / issuer spoofing). When omitted, any
     * syntactically-valid issuer is accepted (subject to the DID-resolution SSRF
     * checks below).
     */
    allowedIssuers?: string[];
}
/** Options controlling SSRF mitigation for {@link resolveDidWeb}. */
export interface ResolveDidWebOptions {
    /**
     * Optional allowlist of acceptable DIDs. When provided, the DID must be an
     * EXACT member or resolution is refused (returns null).
     */
    allowedDids?: string[];
}
/** A W3C DID Document (subset) resolved for an issuer, holding its verification methods. */
export interface DidDocument {
    id: string;
    verificationMethod?: VerificationMethod[];
    authentication?: (string | VerificationMethod)[];
    assertionMethod?: (string | VerificationMethod)[];
}
/** A W3C DID verification method — a public key (JWK or multibase) used to verify issuer signatures. */
export interface VerificationMethod {
    id: string;
    type: string;
    controller: string;
    publicKeyJwk?: JsonWebKey;
    publicKeyMultibase?: string;
}
/**
 * Verifies a Proof-of-Mandate SD-JWT Verifiable Credential.
 *
 * @param compact - The SD-JWT compact serialization string
 * @param options - Verification options
 * @returns Verification result with claims, disclosures, and errors
 */
export declare function verifyProofOfMandate(compact: string, options?: PomVerifyOptions): Promise<PomVerificationResult>;
/**
 * Resolves a `did:web` DID to its DID Document via HTTPS, with SSRF mitigation
 * that works in BOTH the browser and node:
 *  - enforces `https:`
 *  - rejects DIDs whose host is a loopback/private/metadata literal
 *  - supports an optional exact-match `allowedDids` allowlist
 *  - (node only, best-effort) rejects hosts that DNS-resolve to a private range
 *
 * `did:web:api.mandaitor.io` → `https://api.mandaitor.io/.well-known/did.json`
 * Returns null for a non-`did:web` DID, a blocked/disallowed host, or an HTTP
 * error.
 */
export declare function resolveDidWeb(did: string, options?: ResolveDidWebOptions): Promise<DidDocument | null>;
/** List of supported JWS algorithms for user reference */
export declare const SUPPORTED_ALGORITHMS: string[];
declare function base64UrlDecode(input: string): string;
declare function base64UrlEncode(input: string): string;
export { base64UrlEncode as _base64UrlEncode, base64UrlDecode as _base64UrlDecode };
//# sourceMappingURL=pom-verifier.d.ts.map