import { type KeyLocator, type KeyResolution, type KeyResolver, type KeyResolverConfig } from './types.js';
export declare class CyclesKeyResolver implements KeyResolver {
    private readonly failurePolicy;
    private readonly timeoutMs;
    private readonly cachePolicy;
    private readonly fetchImpl;
    private readonly now;
    private readonly cache;
    constructor(config?: KeyResolverConfig);
    canResolve(locator: KeyLocator): boolean;
    resolve(locator: KeyLocator): Promise<KeyResolution>;
    private resolveDidKey;
    private resolveDidWeb;
    private selectVerificationMethod;
    private resolveJwks;
    /** Reconcile a DID-URL fragment kid with an explicit locator.kid.
     *  Returns the agreed kid, undefined if neither is set, or the
     *  AMBIGUOUS sentinel when the two are both set and disagree. */
    private reconcileKid;
    private readCache;
    private writeCache;
    private evictIfNeeded;
    /** Inspect current cache size (observability / tests). */
    cacheSize(): number;
    /** Clear the cache (operational reset / tests). */
    clearCache(): void;
    private fail;
    private storeFail;
    /**
     * Handle an unreachable / transient-network condition under the
     * configured failure policy.
     *  - fail-closed (default): no key; status 'unreachable'; rejects.
     *  - fail-open: a documented-degraded result with NO key material and
     *    degraded=true. It MUST NOT be read as a positive verification.
     * In both modes the result carries no publicKeyHex.
     */
    private unreachable;
}
//# sourceMappingURL=resolver.d.ts.map