import type { ScopeOfClaim } from '../../v2/accountability/types/base.js';
import type { MayActClaim, TokenExchangeClaims, DelegationChainView, RecoveredChain, JwtSvidView, SpiffeIdentityInput } from './types.js';
export * from './types.js';
/**
 * The scope-of-claim this bridge attaches to any receipt that records a mapping.
 * Mirrors the proof box. Callers that mint a receipt around a bridge operation
 * SHOULD use this so the receipt does not over-claim.
 */
export declare function bridgeScopeOfClaim(): ScopeOfClaim;
/**
 * Returns true if `child` authority is no broader than `parent` (subset).
 * A wildcard '*' in the parent matches any child scope. This is the monotonic
 * narrowing invariant: authority may only decrease across a transfer point.
 */
export declare function isNarrowing(parent: string[], child: string[]): boolean;
/**
 * Validate that a chain narrows monotonically from root grant to current actor.
 * Each hop's scope must be a subset of the previous hop's scope. Throws on the
 * first hop that widens authority.
 */
export declare function assertChainNarrows(chain: DelegationChainView): void;
/**
 * Effective authority of a chain: the intersection of every hop's scope. This is
 * the narrowest set that survives all transfer points, i.e. what the current
 * actor may actually do. RFC 8693 transports this as the token `scope` member.
 */
export declare function effectiveScope(chain: DelegationChainView): string[];
/**
 * Express an APS delegation chain as RFC 8693 token-exchange claims.
 *
 * - top-level `sub` = the principal (party being acted upon).
 * - `act` = nested actor chain (current actor outermost, prior actors nested).
 * - `may_act` = the party permitted to become the NEXT actor, when supplied. This
 *   is a forward authorization, distinct from `act` which records who IS acting.
 * - `scope` = the chain's effective (narrowed) authority, space-delimited.
 *
 * This emits a delegation token (it carries `act`), never an impersonation token.
 * Authority is bounded by the narrowed effective scope. The chain MUST narrow
 * monotonically; this is asserted before mapping.
 */
export declare function chainToTokenExchangeClaims(chain: DelegationChainView, options?: {
    /** Party permitted to become the next actor → emitted as `may_act`. */
    mayActBecome?: {
        sub: string;
        iss?: string;
    };
    /** Logical target audience. */
    audience?: string | string[];
    /** Absolute resource URI (no fragment). */
    resource?: string;
    /** Issuer of the exchanged token. */
    iss?: string;
    /** exp (NumericDate). */
    exp?: number;
    /** nbf (NumericDate). */
    nbf?: number;
}): TokenExchangeClaims;
/**
 * Recover an APS delegation chain from RFC 8693 token-exchange claims.
 *
 * The principal is the top-level `sub`. Actors are read from the nested `act`
 * chain, reversed to root-first order. Each recovered hop is delegated FROM the
 * prior actor (or the principal, for the first actor) TO the actor. The token
 * `scope` member is recovered as the chain's effective scope, and each hop is
 * assigned that effective scope as a ceiling, so the recovered chain is provably
 * no broader than the original effective authority.
 *
 * Per RFC 8693 security rules, authorization MUST derive only from the top-level
 * claims plus the OUTERMOST actor. Nested (prior) actors and `may_act` are
 * informational here; the recovered chain carries them for audit but the
 * effective scope is the authorization ceiling.
 */
export declare function tokenExchangeClaimsToChain(claims: TokenExchangeClaims): RecoveredChain;
/** Parse a space-delimited, case-sensitive scope string into a set list. */
export declare function parseScope(scope?: string): string[];
/**
 * Validate that mapping an APS chain to RFC 8693 claims and back does not widen
 * authority. Compares the original chain's effective scope against the recovered
 * chain's effective scope and asserts the recovered set is a subset (no broader).
 * Returns the recovered chain on success; throws if the round-trip widened.
 */
export declare function assertRoundTripNarrows(original: DelegationChainView, recovered: RecoveredChain): void;
/**
 * RFC 8693 Section 4.4: before minting a delegated token, the authorization
 * server SHOULD verify that the presented actor satisfies the subject token's
 * `may_act` constraint. This checks that `actor` matches `may_act`.
 *
 * `may_act` is permission, not proof: a positive result here only means the
 * actor is PERMITTED to act, never that the actor's token was itself valid.
 */
export declare function actorSatisfiesMayAct(mayAct: MayActClaim | undefined, actor: {
    sub: string;
    iss?: string;
}): boolean;
/**
 * Read the current (authorizing) actor from a token's claims. Per RFC 8693, only
 * the OUTERMOST `act` is the current actor and the sole actor that authorization
 * may consider. Returns undefined for an impersonation-shaped token (no `act`).
 */
export declare function currentActor(claims: TokenExchangeClaims): {
    sub: string;
    iss?: string;
} | undefined;
/**
 * Validate a SPIFFE ID against the structural rules of the SPIFFE-ID spec and
 * split it into DID-mappable parts. Reuses parseSPIFFEID for the scheme/authority
 * split, then enforces charset, segment, length, and forbidden-component rules.
 *
 * Rejects: query, fragment, userinfo, port, percent-encoding, empty / '.' / '..'
 * segments, trailing slash, oversized identifiers, and out-of-charset characters.
 */
export declare function validateSpiffeId(spiffeId: string): {
    trustDomain: string;
    pathSegments: string[];
};
/**
 * Resolve a SPIFFE ID string to a DID-method identity input. The only transform
 * is `spiffe://` → `did:<method>:` plus segment delimiting (default ':'). Because
 * SPIFFE forbids userinfo, port, query, and fragment and constrains the charset
 * to a DID-safe subset, the mapping is lossless and needs no escaping.
 *
 * Optionally enforces a trust-domain match against an expected root of trust;
 * a mismatch is rejected before any DID is produced.
 */
export declare function spiffeIdToDidInput(spiffeId: string, options?: {
    method?: string;
    expectedTrustDomain?: string;
    delimiter?: string;
}): SpiffeIdentityInput;
/**
 * Validate a JWT-SVID's header and claims per the SPIFFE JWT-SVID spec, then map
 * its `sub` (which MUST equal the workload SPIFFE ID) to a DID-method input.
 *
 * Rejects (MUST per spec): missing `exp`; missing `aud`; the validator's own ID
 * absent from `aud` when an audience to match is supplied; `alg` outside the
 * approved asymmetric set (no symmetric, no `alg:none`); a `typ` header that is
 * present but not `JWT`/`JOSE`; a `sub` that is not a valid SPIFFE ID.
 */
export declare function jwtSvidToDidInput(svid: JwtSvidView, options?: {
    method?: string;
    expectedAudience?: string;
    expectedTrustDomain?: string;
}): SpiffeIdentityInput;
//# sourceMappingURL=index.d.ts.map