import type { Delegation, ActionReceipt, RevocationRecord, DelegationStatus, CascadeRevocationResult, DelegationChainValidation, RevocationEvent } from '../types/passport.js';
export interface CreateDelegationOptions {
    delegatedTo: string;
    delegatedBy: string;
    scope: string[];
    scopeInterpretation?: 'exact' | 'glob' | 'hierarchical';
    spendLimit?: number;
    spendLimitUnit?: 'currency' | 'invocations';
    maxDepth?: number;
    currentDepth?: number;
    expiresInHours?: number;
    /** Absolute expiry (ISO 8601). When present it WINS over expiresInHours (strict
     *  precedence) and is used directly as the signed expiresAt field. Input only;
     *  never stored as a relative field. subDelegate uses this to pass an
     *  already-capped, absolute child expiry rather than a re-basable duration. */
    expiresAt?: string;
    notBefore?: string;
    derivation_rights?: import('../types/passport.js').DerivationRights;
    observation_policy?: import('../types/passport.js').ObservationPolicy;
    credentialCheckPolicy?: import('../v2/credential-check-policy/types.js').CredentialCheckPolicy;
    privateKey: string;
}
/**
 * Legacy Delegation, a pre-draft compatibility surface. Deprecated.
 *
 * The delegated authority record of draft-pidlisnyi-aps-03 is AuthorityDelegationV1
 * (section 3.1, record_type "aps:authority-delegation:v1"), implemented in
 * src/v2/authority-delegation/. This record is not that one: it predates the draft's
 * wire format, carries a different member set, and is not on the draft path. It is
 * kept so existing deployments keep working, and its authority semantics are frozen.
 *
 * A draft-03 conformant chain is built with issueAuthorityDelegation and
 * issueSubAuthorityDelegation and verified with verifyAuthorityDelegationChain. New
 * work uses those.
 */
export declare function createDelegation(opts: CreateDelegationOptions): Delegation;
export interface SubDelegateOptions {
    parentDelegation: Delegation;
    delegatedTo: string;
    scope: string[];
    spendLimit?: number;
    spendLimitUnit?: 'currency' | 'invocations';
    derivation_rights?: import('../types/passport.js').DerivationRights;
    privateKey: string;
    /** Revocation posture for the PARENT check below. A sub-delegation mints
     *  new authority from the parent, so a caller who requires fresh
     *  revocation evidence before extending authority selects it here.
     *  Omitted leaves the previous behaviour: signature and expiry only. */
    revocation?: RevocationCheckOptions;
}
/**
 * Narrow a legacy Delegation into a child. Pre-draft compatibility surface,
 * deprecated, and frozen: see the note on createDelegation.
 *
 * Its scope narrowing goes through scopeCovers, which is the pre-draft rule and not
 * the rule of draft-pidlisnyi-aps-03 section 3.2. The difference is stated at
 * scopeCovers. The draft-path narrowing check is compareAuthority in
 * src/v2/authority-delegation/compare.ts.
 */
export declare function subDelegate(opts: SubDelegateOptions): Delegation;
/** How a verifier treats the revocation evidence it was given.
 *
 *  - `fail_open`   (default, backward compatible): missing or stale revocation
 *                  evidence does not block. Whatever cached state the caller
 *                  supplies is taken at face value, however old it is.
 *  - `cache_grace` cached evidence is honoured while it is inside the grace
 *                  window and treated as a revocation once it is outside it.
 *  - `fail_closed` the delegation is admissible only against revocation
 *                  evidence that is present AND inside the freshness bound.
 *                  Absent or stale evidence refuses; it does not assert that
 *                  a revocation was observed, only that none can be ruled out.
 *
 *  The three are observably different on the same input, which is the point:
 *  `fail_closed` used to be read into a local and never compared, so it ran
 *  the `fail_open` path and accepted two-hour-old revocation state.
 */
export type RevocationCheckPolicy = 'fail_open' | 'fail_closed' | 'cache_grace';
/** The complete set of accepted policy values, exported so a caller reading a
 *  policy out of configuration can check it before handing it over. */
export declare const REVOCATION_CHECK_POLICIES: readonly RevocationCheckPolicy[];
/** Default freshness bound for cached revocation evidence, in milliseconds.
 *  Used by `cache_grace` as the grace window and by `fail_closed` as the
 *  maximum age of evidence it will accept. */
export declare const DEFAULT_REVOCATION_FRESHNESS_MS = 300000;
/** The revocation posture a caller can select, as one object.
 *
 *  Every primitive in the SDK that verifies a delegation on the caller's
 *  behalf accepts this, so selecting `fail_closed` is reachable from a
 *  shipped entrypoint rather than only from a direct verifyDelegation call.
 *  Omitting it everywhere leaves the previous behaviour exactly: the
 *  policy defaults to `fail_open` and no revocation evidence is consulted. */
export interface RevocationCheckOptions {
    /** How to handle missing or stale revocation evidence. Default:
     *  'fail_open' (backward compat). See RevocationCheckPolicy. */
    revocationCheckPolicy?: RevocationCheckPolicy;
    /** Cached revocation state. The SDK holds no revocation registry, so this
     *  is the entire evidence base; live lookups live in DelegationStore. */
    cachedRevocationState?: {
        revoked: boolean;
        checkedAt: string;
    };
    /** Maximum accepted age of that evidence, in ms. Grace window for
     *  'cache_grace', freshness bound for 'fail_closed'. Default 300000. */
    cacheGraceMs?: number;
}
/**
 * Verify a legacy Delegation. Pre-draft compatibility surface, deprecated, frozen:
 * see the note on createDelegation.
 *
 * This is not the draft-03 chain verifier. draft-pidlisnyi-aps-03 section 3.3 runs a
 * root-to-leaf chain through a fixed order of checks and returns one of valid,
 * invalid, indeterminate or unsupported; that is verifyAuthorityDelegationChain in
 * src/v2/authority-delegation/verify.ts. This function checks one legacy record's
 * signature, window and depth, and reads revocation only from what the caller passed.
 */
export declare function verifyDelegation(delegation: Delegation, opts?: RevocationCheckOptions & {
    /** Walk parent chain and check each ancestor's revocation status.
     *  No-op without a DelegationStore; the option is preserved for API
     *  compatibility but ancestor walks now require store.validateChain(). */
    checkAncestors?: boolean;
}): DelegationStatus;
export declare function verifyRevocation(revocation: RevocationRecord): boolean;
export interface CreateReceiptOptions {
    agentId: string;
    delegationId: string;
    delegation: Delegation;
    action: ActionReceipt['action'];
    result: ActionReceipt['result'];
    delegationChain: string[];
    privateKey: string;
    /** Revocation posture for the delegation check below. Minting a receipt
     *  is the record that an action was taken under this delegation, so a
     *  caller who will not act on unknown revocation state selects
     *  fail_closed here. Omitted leaves the previous behaviour. */
    revocation?: RevocationCheckOptions;
}
export declare function createReceipt(opts: CreateReceiptOptions): ActionReceipt;
export declare function verifyReceipt(receipt: ActionReceipt, agentPublicKey: string): {
    valid: boolean;
    errors: string[];
};
export declare function scopeCovers(granted: string, required: string): boolean;
export declare function scopeAuthorizes(delegationScope: string[], required: string): boolean;
export declare function revokeDelegation(_delegationId: string, _revokedBy: string, _reason: string, _privateKey: string): RevocationRecord;
export declare function cascadeRevoke(_delegationId: string, _revokedBy: string, _reason: string, _privateKey: string): CascadeRevocationResult;
export declare function revokeByAgent(_agentPublicKey: string, _revokedBy: string, _reason: string, _privateKey: string): RevocationRecord[];
export declare function validateChain(_delegationIds: string[]): DelegationChainValidation;
export declare function getDescendants(_delegationId: string): string[];
export declare function getChainEntry(_delegationId: string): undefined;
export declare function onRevocation(_listener: (event: RevocationEvent) => void): () => void;
export declare function getReceipts(_agentId?: string): ActionReceipt[];
export declare function getRevocation(_delegationId: string): RevocationRecord | undefined;
export declare function getSpent(_delegation: Delegation): number;
/**
 * Back-compat no-op. The SDK no longer holds module-scope state, so there
 * is nothing to clear. Still exported because test suites historically
 * called it in beforeEach hooks.
 */
export declare function clearStores(): void;
//# sourceMappingURL=delegation.d.ts.map