/**
 * The publishable key:
 * `st_pk_<env>_<base64url(JSON { organizationId, apiBase, sig })>`.
 *
 * The publishable key is a signed credential minted in the dashboard. Every
 * stream request must carry it (`st-key` query param, see protocol.ts). Test
 * keys (st_pk_test_) work on their own for development; live keys
 * (st_pk_live_) only work from an origin registered to your organization.
 * Treat it like any client-side key: it is visible in page source, so
 * protection comes from the origin registry and rate limits; rotate it from
 * the dashboard if it leaks.
 *
 * The SDK decodes the payload locally (zero network) to fill organizationId
 * and apiBase, and ignores every other field — `sig` included. It holds no
 * secret, so it cannot verify or produce a signature; only the server does.
 * `organizationId` and `apiBase` remain explicit props for self-hosted bases
 * — when both are given, the explicit props win for addressing, and the key
 * is still sent as the credential.
 *
 * Because the client cannot verify the signature, an apiBase that arrives VIA
 * a key is still an unproven host client-side. Content fetches may follow it,
 * but the mint token — a spend credential — may not: the mint POST fires only
 * for an explicit, first-party (*.sparkletree.io, *.qrtree.ai), or loopback apiBase
 * (security review S-2; see isFirstPartyApiBase/maybeMint).
 */
export interface PublishableKeyPayload {
    organizationId: string;
    apiBase: string;
}
export type PublishableKeyEnv = "live" | "test";
/**
 * Decode a publishable key. Throws TypeError on anything malformed — a bad
 * key is a configuration error at integration time, not a runtime condition
 * to degrade around.
 */
export declare function decodePublishableKey(key: string): PublishableKeyPayload;
/**
 * Encode the ADDRESSING half of a publishable key — organizationId and
 * apiBase, no `sig`. The SDK holds no secret, so a key encoded here is
 * unsigned and the server rejects it (`unsigned`) when enforcement is on.
 * Signed keys are minted in the dashboard. This exists for tests and for
 * self-hosters who run their own signer downstream.
 */
export declare function encodePublishableKey(options: {
    organizationId: string;
    apiBase: string;
    env: PublishableKeyEnv;
}): string;
//# sourceMappingURL=publishableKey.d.ts.map