import { AgentErrorCode, ActionEnvelope, DelegationEnvelope, SubdelegationEnvelope, RevocationEnvelope, ChainLink, VerifyActionResult, VerifyDelegationResult, VerifyRevocationResult, VerifySubdelegationResult, ActorRef, DelegationBond, DelegationRevocationRef, ScopesEncryptedEnvelope } from './types.mjs';
export { ActionCanonicalInput, ActionContent, ActionOts, DelegationCanonicalInput, ENVELOPE_VERSION, EnvelopeKind, RevocationCanonicalInput, RevocationHolder, Signature, SubdelegationCanonicalInput, VerifyActionOkExtra, VerifyErr, VerifyOk } from './types.mjs';
export { actionCanonicalBytes, actionCanonicalMessage, canonicalActionBytes, canonicalDelegationBytes, canonicalRevocationBytes, canonicalizeAction, canonicalizeDelegation, canonicalizeRevocation, canonicalizeScopes, computeActionId, computeDelegationId, computeRevocationId, computeSubdelegationId, delegationCanonicalBytes, delegationCanonicalMessage, parseAndCanonicalizeScopes, revocationCanonicalBytes, revocationCanonicalMessage, sha256Hex, subdelegationCanonicalBytes, subdelegationCanonicalMessage } from './canonical.mjs';
import { ValidationOptions } from './scope.mjs';
export { REGISTERED_SCOPES, Scope, ScopeConstraint, ScopeOp, ScopeParseError, canonicalizeScope, canonicalizeScopeString, isSubScope, parseScope, validateScope } from './scope.mjs';
import { SealInput, DeviceRecord, UnsealInput } from '@orangecheck/lock-core';
export { canonicalize, hexEncode } from '@orangecheck/stamp-core/canonical';

declare const DEFAULT_MAX_CHAIN_DEPTH = 5;
interface VerifyBase {
    verifyBip322?: (msg: string, signatureB64: string, address: string) => Promise<boolean>;
    skipSignatureVerification?: boolean;
    scopeMode?: ValidationOptions['mode'];
}
declare class AgentError extends Error {
    code: AgentErrorCode;
    constructor(code: AgentErrorCode, message: string);
}
interface VerifyDelegationInput extends VerifyBase {
    envelope: DelegationEnvelope;
    now?: Date;
    skipTemporalCheck?: boolean;
    decryptScopesWith?: {
        device_id: string;
        secretKey: Uint8Array;
    };
}
declare function verifyDelegation(input: VerifyDelegationInput): Promise<VerifyDelegationResult>;
interface VerifyActionInput extends VerifyBase {
    action: ActionEnvelope;
    delegation: DelegationEnvelope;
    subdelegationChain?: SubdelegationEnvelope[];
    maxChainDepth?: number;
    revocations?: RevocationEnvelope[];
    content?: Uint8Array;
    verifyOtsAnchor?: (proofB64: string, blockHeight: number, blockHash: string) => Promise<boolean>;
    resolveAnchorBlockHeight?: (env: ActionEnvelope | RevocationEnvelope) => number | null;
    decryptScopesWith?: {
        device_id: string;
        secretKey: Uint8Array;
    };
}
declare function verifyAction(input: VerifyActionInput): Promise<VerifyActionResult>;
interface VerifyRevocationInput extends VerifyBase {
    envelope: RevocationEnvelope;
    delegation: ChainLink;
}
declare function verifyRevocation(input: VerifyRevocationInput): Promise<VerifyRevocationResult>;
interface VerifySubdelegationInput extends VerifyBase {
    envelope: SubdelegationEnvelope;
    parent: ChainLink;
    skipTemporalCheck?: boolean;
    now?: Date;
    decryptScopesWith?: {
        device_id: string;
        secretKey: Uint8Array;
    };
}
declare function verifySubdelegation(input: VerifySubdelegationInput): Promise<VerifySubdelegationResult>;

interface FederationGuardian {
    address: string;
    alg: 'bip322';
    name?: string;
}
interface FederationDescriptor {
    v: 1;
    kind: 'agent-federation';
    threshold: string;
    guardians: FederationGuardian[];
}
interface FederationPrincipal {
    alg: 'federation';
    descriptor_id: string;
    descriptor: FederationDescriptor;
}
interface FederationSignature {
    alg: 'federation-bip322';
    threshold: string;
    signatures: Array<{
        guardian_address: string;
        value: string;
    }>;
}
interface FederationDelegationEnvelope {
    v: 1;
    kind: 'agent-delegation';
    id: string;
    principal: FederationPrincipal;
    agent: ActorRef;
    scopes: string[];
    bond: DelegationBond | null;
    issued_at: string;
    expires_at: string;
    nonce: string;
    revocation: DelegationRevocationRef;
    sig: FederationSignature;
}
interface FederationRevocationEnvelope {
    v: 1;
    kind: 'agent-revocation';
    id: string;
    delegation_id: string;
    signer: FederationPrincipal;
    reason: string;
    signed_at: string;
    ots?: unknown | null;
    sig: FederationSignature;
}
type FederationVerifyResult = {
    ok: true;
    id: string;
    canonicalMessage: string;
} | {
    ok: false;
    code: AgentErrorCode;
    message: string;
};
interface VerifyFederationBase {
    verifyBip322?: (msg: string, signatureB64: string, address: string) => Promise<boolean>;
    skipSignatureVerification?: boolean;
}
declare function federationDescriptorCanonicalMessage(descriptor: FederationDescriptor): string;
declare function computeFederationDescriptorId(descriptor: FederationDescriptor): string;
interface VerifyFederationDelegationInput extends VerifyFederationBase {
    envelope: FederationDelegationEnvelope;
    now?: Date;
    skipTemporalCheck?: boolean;
}
declare function verifyFederationDelegation(input: VerifyFederationDelegationInput): Promise<FederationVerifyResult>;
interface VerifyFederationRevocationInput extends VerifyFederationBase {
    envelope: FederationRevocationEnvelope;
}
declare function verifyFederationRevocation(input: VerifyFederationRevocationInput): Promise<FederationVerifyResult>;

declare function encodeScopesPayload(scopes: string[]): Uint8Array;
declare function decodeScopesPayload(bytes: Uint8Array): string[];
interface SealScopesInput {
    scopes: string[];
    sender: SealInput['sender'];
    recipients: DeviceRecord[];
    hint?: string;
    expiresAt?: Date | null;
}
declare function sealScopes(input: SealScopesInput): Promise<ScopesEncryptedEnvelope>;
interface UnsealScopesInput {
    envelope: ScopesEncryptedEnvelope;
    device: UnsealInput['device'];
    verifyBip322?: UnsealInput['verifyBip322'];
    skipSenderVerification?: boolean;
}
interface UnsealedScopes {
    scopes: string[];
    sender: {
        address: string;
        attestation_id?: string;
    };
    matchedDeviceId: string;
}
declare function unsealScopes(input: UnsealScopesInput): Promise<UnsealedScopes>;
declare function hasPrivateScopes<T extends {
    scopes?: string[];
    scopes_encrypted?: ScopesEncryptedEnvelope;
}>(envelope: T): envelope is T & {
    scopes_encrypted: ScopesEncryptedEnvelope;
};

export { ActionEnvelope, ActorRef, AgentError, AgentErrorCode, ChainLink, DEFAULT_MAX_CHAIN_DEPTH, DelegationBond, DelegationEnvelope, DelegationRevocationRef, type FederationDelegationEnvelope, type FederationDescriptor, type FederationGuardian, type FederationPrincipal, type FederationRevocationEnvelope, type FederationSignature, type FederationVerifyResult, RevocationEnvelope, ScopesEncryptedEnvelope, type SealScopesInput, SubdelegationEnvelope, type UnsealScopesInput, type UnsealedScopes, ValidationOptions, type VerifyActionInput, VerifyActionResult, type VerifyBase, type VerifyDelegationInput, VerifyDelegationResult, type VerifyFederationBase, type VerifyFederationDelegationInput, type VerifyFederationRevocationInput, type VerifyRevocationInput, VerifyRevocationResult, type VerifySubdelegationInput, VerifySubdelegationResult, computeFederationDescriptorId, decodeScopesPayload, encodeScopesPayload, federationDescriptorCanonicalMessage, hasPrivateScopes, sealScopes, unsealScopes, verifyAction, verifyDelegation, verifyFederationDelegation, verifyFederationRevocation, verifyRevocation, verifySubdelegation };