import type { VerifiablePresentation } from '../types/did.js';
import type { ProviderAttestation } from '../types/attestation.js';
export interface CredentialRequest {
    /** Unique request ID */
    id: string;
    /** Claims the verifier wants (e.g., ["grade", "capabilities", "delegationScope"]) */
    requestedClaims: string[];
    /** DID of the verifier making the request */
    verifierDID: string;
    /** Challenge nonce for replay protection */
    challenge: string;
    /** When this request was created */
    createdAt: string;
}
export interface CredentialResponseResult {
    valid: boolean;
    /** Extracted claims that the verifier requested */
    claims: Record<string, unknown>;
    /** Detailed checks */
    checks: string[];
}
export interface SelectivePassport {
    agentId: string;
    publicKey: string;
    agentName?: string;
    mission?: string;
    capabilities?: string[];
    grade?: number;
    delegationScope?: string[];
    createdAt?: string;
    expiresAt?: string;
    evidence?: ProviderAttestation[];
}
/**
 * Create a credential request specifying which claims the verifier needs.
 * The challenge provides replay protection: the agent must bind the VP
 * to this specific challenge.
 */
export declare function createCredentialRequest(claims: string[], verifierDID: string, challenge?: string): CredentialRequest;
/**
 * Fulfill a credential request by creating a VP that contains only
 * the requested claims. This is selective disclosure: the agent
 * reveals only what the verifier asked for.
 *
 * The VC's credentialSubject will contain:
 * - id (always included, the agent's did:key)
 * - agentId (always included for APS correlation)
 * - only the fields listed in request.requestedClaims
 */
export declare function fulfillCredentialRequest(request: CredentialRequest, passport: SelectivePassport, privateKey: string): Promise<VerifiablePresentation>;
/**
 * Verify a credential response and extract the requested claims.
 *
 * SCOPE OF CLAIM.
 *   Establishes, when `valid` is true: everything
 *     {@link verifyVerifiablePresentation} establishes — presentation and
 *     credential integrity, holder and issuer binding, proof purpose, expiry,
 *     and that the response answers the challenge and domain the caller
 *     expected.
 *   Does NOT establish: that the challenge has not already been spent, which
 *     is the verifier's own state to keep; that the holder is entitled to
 *     present these credentials; or that the extracted claims are true.
 *
 * The verification is delegated rather than repeated. This module carried its
 * own copy of the presentation and credential checks, with the same two
 * defects: the verification key came from the proof rather than from the
 * claimed issuer or holder, and the challenge it compared was outside the
 * signed bytes, so the replay protection this function's own header advertised
 * was defeated by rewriting the field it compared. One implementation cannot
 * drift from itself.
 *
 * `expectedChallenge` is required. A credential response answers a request
 * that carried a challenge, so a response verified against no challenge is a
 * response to nothing in particular, and the nonce is what stops it being
 * replayed. `expectedDomain` stays optional on the same terms as the
 * presentation verifier it delegates to.
 */
export declare function verifyCredentialResponse(vp: VerifiablePresentation, expectedChallenge: string, expectedDomain?: string): Promise<CredentialResponseResult>;
//# sourceMappingURL=credential-request.d.ts.map