/** Whether the signing key was shown to belong to the claimed identity.
 *   - 'verified'   : the DID commits to this key.
 *   - 'rejected'   : the DID commits to a different key, or names a different
 *                    identity than the document claims.
 *   - 'unresolved' : the DID method is not self-certifying, so the binding
 *                    cannot be established without resolving a DID document.
 *                    NOT an acceptance. */
export type KeyAuthority = 'verified' | 'unresolved' | 'rejected';
export type ProofBinding = {
    keyAuthority: 'verified';
    publicKey: string;
} | {
    keyAuthority: 'unresolved' | 'rejected';
    reason: string;
};
/**
 * Bind a proof's `verificationMethod` to the identity the document claims.
 *
 * Both halves are checked, because either alone is insufficient. The DID
 * before the fragment must be the claimed DID, or the proof is a proof by
 * somebody else. And the key must derive from that DID, or the DID string and
 * the key material are unrelated assertions sitting next to each other.
 *
 * Only self-certifying methods can be bound offline: did:key and the legacy
 * did:aps, both of which encode the Ed25519 key in the identifier itself.
 * Every other method needs a resolved DID document, and this SDK has no
 * resolver on these surfaces, so it reports 'unresolved' and the caller
 * refuses. That is a compatibility break for any did:web credential that used
 * to verify here, and it is the intended one: it never established anything.
 *
 * The FRAGMENT is deliberately not constrained. A self-certifying DID commits
 * to exactly one key, so the fragment selects nothing and cannot be used to
 * substitute key material. A fragment the controller does not list is a
 * document-conformance defect, not an authority one, and catching it needs the
 * DID document this function does not fetch.
 */
export declare function bindVerificationMethod(claimedDid: unknown, verificationMethod: unknown): ProofBinding;
/**
 * Refuse presentation proof options a verifier could never accept.
 *
 * The types require `challenge`, but a JavaScript caller is not typed, and a
 * presentation minted without one is permanently unverifiable: both
 * presentation verifiers require an expected challenge and a proof carrying
 * none is refused. Minting an artifact this SDK's own verifier will always
 * reject is the creator-verifier disagreement the attestation path already
 * refuses to ship, and it applies here for the same reason.
 *
 * `domain` stays optional. What it may not be is present and unusable: an
 * empty string or a non-string reads as a domain the presentation is addressed
 * to, and it addresses nothing.
 *
 * Creators throw; verifiers do not. A verifier that throws is not a verifier
 * that rejects, and a relying party branches on the verdict. A creator has a
 * caller who can still fix the input, and this is the one moment they can.
 *
 * @throws TypeError when `challenge` is absent, not a string, or empty, or
 * when `domain` is present and is not a non-empty string.
 */
export declare function assertPresentationProofOptions(options: {
    challenge: string;
    domain?: string;
} | undefined, fn: string): void;
/**
 * The bytes a proof is made over: the document with its `proof` member
 * replaced by the proof configuration, which is the proof minus `proofValue`.
 *
 * Signing and verification MUST both go through this, or every credential in
 * existence stops verifying against half a change. The canonicalizer is
 * supplied by the caller so the repo's write-boundary rule survives:
 * canonicalizeForWrite when signing, canonicalize when rebuilding the preimage
 * of an artifact that already exists.
 */
export declare function proofSigningInput(document: Record<string, unknown>, proof: Record<string, unknown>, canon: (value: unknown) => string): string;
//# sourceMappingURL=vc-proof.d.ts.map