/**
 * `@noy-db/hub/broker` — subpath export for the credential-broker capability
 * (#479, credential-broker spec). Apps that never call `vault.broker()` can
 * exclude this subpath entirely: the floor default `NO_BROKER` throws, and
 * this module's real engine (`with-party/broker/{seed,active}.ts`) is only
 * ever reached through `withBroker()`'s dynamic imports, so it never enters
 * a floor bundle.
 *
 * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)
 * from the enclave barrel, so a Lambda/Worker implementing the reference
 * broker host can import just this one subpath and get everything it
 * needs, `crypto.subtle`-only.
 */
export { withBroker } from './active.js';
export { NO_BROKER, type BrokerStrategy, type BrokerCtx, type BrokerConfig, type CredentialBrokerHandle, } from '../../port/with/broker-strategy.js';
export { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js';
import { verifyBrokerProof } from '../../kernel/enclave/index.js';
import type { IssuedChallenge, VerifyBrokerProofArgs } from '../../kernel/enclave/index.js';
/**
 * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a
 * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel
 * gets a safe challenge TTL without having to know the bounds itself.
 */
export declare function issueChallenge(opts?: {
    ttlMs?: number;
}): IssuedChallenge;
export { verifyBrokerProof };
export type { VerifyBrokerProofArgs };