/**
 * Manifest identity binding.
 *
 * bindManifestToIdentity: verify a signed manifest against an identity graph.
 * verifyManifestIdentity: core verification logic.
 *
 * Security model for valid signer addresses:
 *   A manifest signer is authorized if the signing address is one of:
 *   1. The identity's rootAddress
 *   2. The identity's controllerAddress
 *   3. An address in authorizedAddresses (delegates with "manifest:sign" or "*" scope)
 * Root-identity proofs are verified and must resolve to the identity's root,
 * but a root-proven child does NOT grant `manifest:sign` by itself. Proven
 * addresses are returned as evidence only.
 *
 * Note: controlledAddresses (delegates with any scope) are NOT included in the
 * manifest-signing valid set. Only explicitly scoped manifest signers may bind.
 *
 * Verification order:
 *   1. verifyManifest (manifest signature must be valid)
 *   2. resolveIdentityGraph (traverse graph)
 *   3. Optional root-identity proof verifier hooks
 *   4. Address membership check
 *   5. Identity status check (revoked = invalid)
 */
import type { SignedManifest } from '@totemsdk/manifest';
import type { IdentityGraph, ManifestIdentityBinding, IdentityProofVerifier } from './types.js';
export declare function verifyManifestIdentity(signedManifest: SignedManifest<any>, identityGraph: IdentityGraph, options?: {
    proofVerifiers?: Record<string, IdentityProofVerifier>;
    /** Explicit resolution time. Defaults to Date.now() for compatibility. */
    asOf?: number;
}): Promise<ManifestIdentityBinding>;
export declare function bindManifestToIdentity(signedManifest: SignedManifest<any>, identityGraph: IdentityGraph, options?: {
    proofVerifiers?: Record<string, IdentityProofVerifier>;
}): Promise<ManifestIdentityBinding>;