/**
 * `delegates` namespace — scoped, revocable, expiring credentials an OWNER
 * mints for an agent (gateway `cryptographic-delegates`, v1.79). Maps to
 * `/projects/v1/:project_id/delegates`. Every mutation requires the caller to
 * be an active owner of the project's owning org.
 *
 * A delegate always NARROWS an existing `project_grant` — mint the grant first
 * (`r.grants.create(...)`), then hang a delegate off its `grant_id`. A delegate
 * can never be an owner; that is enforced structurally by the gateway.
 *
 * The practical reason this exists on the client: project API keys are
 * stateless JWTs handed out once at create and never re-issued, so an agent
 * that loses local state has no way back into its own project. A delegate is
 * the supported recovery path — the owner still holds a wallet, and SIWX is
 * enough to mint a fresh deploy credential.
 *
 * Exposed both unscoped (`r.delegates.create(projectId, …)`) and
 * project-scoped (`r.project(id).delegates.create(…)`), mirroring `r.grants`.
 */
import type { Client } from "../kernel.js";
import type { CreateDelegateInput, DelegateCreateResult, DelegateListResult, DelegateRevokeResult } from "./delegates.types.js";
export declare class Delegates {
    private readonly client;
    constructor(client: Client);
    /**
     * Issue a delegate against an existing grant
     * (`POST /projects/v1/:project_id/delegates`). Requires owner of the project's org.
     *
     * The returned `token` is shown **once**. Persist it immediately; there is no
     * way to read it back, only to rotate for a new one.
     */
    create(projectId: string, input: CreateDelegateInput): Promise<DelegateCreateResult>;
    /**
     * List a project's delegates (`GET /projects/v1/:project_id/delegates`).
     * Never returns a token or any secret material — names, scope and caps only.
     */
    list(projectId: string): Promise<DelegateListResult>;
    /**
     * Revoke a delegate (`DELETE /projects/v1/:project_id/delegates/:delegate_id`).
     * Effective immediately for subsequent requests.
     */
    revoke(projectId: string, delegateId: string): Promise<DelegateRevokeResult>;
    /**
     * Rotate a delegate (`POST /projects/v1/:project_id/delegates/:delegate_id/rotate`)
     * — revokes the old credential and reissues the same principal/grant/scope/cap.
     * The new `token` is again shown once.
     */
    rotate(projectId: string, delegateId: string): Promise<DelegateCreateResult>;
}
//# sourceMappingURL=delegates.d.ts.map