import type { RotatableDIDDocument } from '../../../types/passport.js';
export type MppResolveDidDocument = (agentId: string) => Promise<RotatableDIDDocument | null>;
import type { OwnerConfirmation, V2Delegation } from '../../types.js';
import type { DenialReason as FoundationDenialReason } from '../types.js';
export { MPP_VERSION } from './types.js';
import type { MppApsReceipt, MppDenial, MppDenialReason, MppMethodType, MppPaymentChallenge, MppVerifyResult } from './types.js';
/**
 * Deterministic mapping from an APS denial reason to the MPP-side
 * HTTP envelope a resource server would have returned. Status codes
 * follow the IETF draft's split between 402 (retryable payment
 * issue), 403 (hard policy denial), 410 (gone — token/wallet
 * revoked), and 503 (version mismatch / cannot serve).
 *
 * The www_authenticate_error token follows RFC 6750 §3.1 conventions:
 *   - invalid_request : malformed challenge or authorization
 *   - invalid_token   : payment proof or delegation rejected
 *   - insufficient_funds : APS budget exhausted
 *   - expired         : challenge or delegation past valid_until
 */
export declare function apsToMppHttpError(reason: MppDenialReason): {
    http_status: 402 | 403 | 410 | 503;
    www_authenticate_error: 'invalid_request' | 'invalid_token' | 'insufficient_funds' | 'expired';
};
/**
 * Map an MPP-specific denial reason to the foundation Tier-1
 * DenialReason taxonomy. See
 * docs/governance/payment-rails-denial-vocabulary.md.
 */
export declare function mapMppDenialToFoundation(reason: MppDenialReason): FoundationDenialReason;
export interface MppAllowedFromDelegation {
    /** Allowed method_type values (open string set). */
    allowed_methods: string[];
    /** ISO 4217 lowercase OR token contract addr. Empty = no constraint. */
    allowed_currencies: string[];
    /** Hard cap per single MPP charge in minor units. null = no cap. */
    max_amount_per_charge: number | null;
    /** Token expiry — ISO 8601 of policy_context.valid_until if set. */
    valid_until?: string;
}
/**
 * Project a V2Delegation into the MPP context it permits. Used by
 * preAuthorizeMppPayment and by callers that want to render the
 * delegation as a method/currency allow-list before the agent
 * touches the resource.
 *
 * Field sourcing (matches AP2 / ACP / Stripe-Issuing conventions):
 *   - max_amount_per_charge ← resolveSpendLimitCents(delegation)
 *     [walks resource_limits.spend_limit_cents → commerce.spend_limit
 *     alias → constraints.spend_limit_cents string]
 *   - allowed_methods ← scope.constraints.allowed_payment_methods (CSV)
 *   - allowed_currencies ← scope.constraints.allowed_currencies (CSV)
 *   - valid_until ← policy_context.valid_until
 */
export declare function delegationToMppAllowed(delegation: V2Delegation): MppAllowedFromDelegation;
export type MppPreAuthorizeResult = {
    allow: true;
} | {
    allow: false;
    reason: MppDenialReason;
    detail?: string;
};
export interface PreAuthorizeMppOptions {
    /** Override for deterministic tests of challenge_expired path. */
    now?: Date;
    /** Owner-signed confirmation, when the delegation declares an
     *  escalation_requirement on action_class 'payment' with
     *  requires_owner_confirmation: true. The gate runs the full
     *  verifyOwnerConfirmation() chain. */
    owner_confirmation?: OwnerConfirmation;
    /** Per-action confirmation_scope binds details_hash. MPP defaults
     *  to hashing the canonical challenge when omitted. */
    action_details?: Record<string, unknown>;
    /** session_id for 'per_session' confirmation scope. */
    session_id?: string | null;
}
/**
 * Decide whether a 402 challenge can be satisfied under a delegation.
 * Pure function; no I/O, no side effects, no state. The gate returns
 * allow:true if AT LEAST ONE listed method matches the delegation's
 * method/currency/amount allow-list and neither the challenge nor
 * the delegation has expired.
 *
 * Fail-closed ordering: scope → delegation expiry → challenge expiry
 * → method allow-list → currency allow-list → per-charge cap. The
 * first failing check decides the reason.
 */
export declare function preAuthorizeMppPayment(challenge: MppPaymentChallenge, delegation: V2Delegation, options?: PreAuthorizeMppOptions): MppPreAuthorizeResult;
export interface SignMppReceiptInput {
    challenge_id: string;
    method_type: MppMethodType;
    amount_paid: string;
    currency: string;
    paid_at: string;
    resource: string;
    delegation_ref?: string;
    agent_id: string;
    /** Phase 4.1 / Q1: opt into AccountabilityReceiptBase shape. */
    accountability_shape?: boolean;
    /** Override the rail's default scope_of_claim (implies accountability_shape). */
    scope_of_claim?: import('../../accountability/types/base.js').ScopeOfClaim;
    /** Phase 4.1 / P12: when supplied alongside `issuer_key_ref`, signer
     *  becomes a DID URI of the form `${issuer_agent_id}#${issuer_key_ref}`.
     *  Compatible-superset; legacy raw-hex signer when either is omitted. */
    issuer_agent_id?: string;
    issuer_key_ref?: string;
    /** Phase 4.1 / Q2: link to the AttributionReceipt this MPP exchange
     *  pays against. */
    attribution_receipt_id?: string;
    /** Phase 4.1 / Q2: link to the SettlementRecord whose payment_obligations
     *  declared this payment. */
    settlement_record_id?: string;
}
export declare function signMppReceipt(input: SignMppReceiptInput, signerPrivateKeyHex: string): MppApsReceipt;
export interface VerifyMppOptions {
    now?: Date;
    ttl_seconds?: number;
    expected_signer?: string;
    /** Phase 4.1 / P12: required when signer is a DID URI. The async
     *  `verifyMppReceiptWithDID` / `verifyMppDenialWithDID` paths invoke
     *  this resolver. The sync path returns DID_RESOLVER_MISSING. */
    resolveDidDocument?: MppResolveDidDocument;
}
export declare function verifyMppReceipt(receipt: MppApsReceipt, options?: VerifyMppOptions): MppVerifyResult;
/** Phase 4.1 / P12: async receipt verifier with DID URI support. */
export declare function verifyMppReceiptWithDID(receipt: MppApsReceipt, options?: VerifyMppOptions): Promise<MppVerifyResult>;
export interface SignMppDenialInput {
    challenge_id?: string;
    method_type?: MppMethodType;
    reason: MppDenialReason;
    delegation_ref?: string;
    agent_id: string;
    /** Phase 4.1 / P12: see SignMppReceiptInput.issuer_agent_id. */
    issuer_agent_id?: string;
    issuer_key_ref?: string;
}
export declare function signMppDenial(input: SignMppDenialInput, signerPrivateKeyHex: string): MppDenial;
export declare function verifyMppDenial(denial: MppDenial, options?: VerifyMppOptions): MppVerifyResult;
/** Phase 4.1 / P12: async denial verifier with DID URI support. */
export declare function verifyMppDenialWithDID(denial: MppDenial, options?: VerifyMppOptions): Promise<MppVerifyResult>;
//# sourceMappingURL=index.d.ts.map