import { type KeyAuthority } from './vc-proof.js';
import type { VerifiableCredential, VerifiablePresentation } from '../types/did.js';
import type { ProviderAttestation } from '../types/attestation.js';
export interface PassportVCInput {
    agentId: string;
    publicKey: string;
    agentName?: string;
    mission?: string;
    capabilities?: string[];
    grade?: number;
    delegationScope?: string[];
    createdAt?: string;
    expiresAt?: string;
    /** SPIFFE or other infrastructure attestation to include as evidence */
    evidence?: ProviderAttestation[];
}
export interface VCVerifyResult {
    /** Integrity AND issuer binding, plus expiry. Not an authorization decision:
     *  the caller allowlists on `issuerDID`. */
    valid: boolean;
    /** The issuer the credential claims, returned so the caller can allowlist
     *  it. Empty when the binding failed, because an unbound issuer field names
     *  nobody who has been shown to have signed anything. */
    issuerDID: string;
    /** The proof verifies under the key its own verificationMethod names. */
    proofOfPossession: boolean;
    /** Whether that key was shown to belong to the claimed issuer. */
    keyAuthority: KeyAuthority;
    checks: string[];
}
export interface VPVerifyResult {
    valid: boolean;
    /** The holder the presentation claims, on the same terms as issuerDID. */
    holderDID: string;
    proofOfPossession: boolean;
    keyAuthority: KeyAuthority;
    /** The challenge and domain carried in the verified proof. Consuming a
     *  challenge is relying-party state, so the verified value is returned
     *  rather than enforced here. */
    challenge?: string;
    domain?: string;
    credentials: VerifiableCredential[];
    checks: string[];
}
/**
 * Wrap an APS passport as a W3C Verifiable Credential using did:key
 * as the subject identifier.
 *
 * credentialSubject includes grade and delegationScope (the delegation
 * ceiling). If evidence (e.g., from importSPIFFESVID) is provided, it
 * is attached to the VC as W3C evidence, proving the identity claim
 * is backed by infrastructure attestation.
 */
export declare function passportToVerifiableCredential(passport: PassportVCInput, issuerPrivateKey: string): Promise<VerifiableCredential>;
/**
 * Verify a Verifiable Credential's Ed25519 proof.
 *
 * SCOPE OF CLAIM.
 *   Establishes, when `valid` is true: the credential and its proof
 *     configuration are unaltered since signing, the signing key is the one
 *     the DID in `issuer` commits to, the proof was made for a credential
 *     purpose, and the credential has not expired.
 *   Does NOT establish: that the issuer is trusted (allowlist on `issuerDID`),
 *     that the claims are true, that attached evidence was checked — the
 *     `checks` array reports evidence PRESENCE and says so — or that the
 *     credential has not been revoked.
 *
 * The verification key used to come from `proof.verificationMethod` with no
 * relation to `issuer`, and the non-did:key branch took the last colon-
 * separated segment of the identifier as raw key material, so a credential
 * naming a trusted did:key issuer and carrying a did:aps proof over the
 * attacker's own key verified. Both are closed: the method DID must be the
 * issuer DID, and the key must derive from it.
 */
export declare function verifyVerifiableCredential(vc: VerifiableCredential): Promise<VCVerifyResult>;
/**
 * Wrap one or more VCs into a Verifiable Presentation for a verifier.
 * Uses did:key for the holder identifier.
 *
 * The challenge is required and is inside the signed bytes, so the
 * presentation is bound to the request it answers and cannot be readdressed.
 */
export declare function createVerifiablePresentation(credentials: VerifiableCredential[], holderPrivateKey: string, options: {
    /** The verifier's nonce this presentation answers. REQUIRED, on the same
     *  terms as the twin in vc.ts: verifyVerifiablePresentation requires one,
     *  so minting a presentation without it would produce an artifact this
     *  SDK's own verifier can never accept. */
    challenge: string;
    /** The verifier this presentation is addressed to. Optional. */
    domain?: string;
}): Promise<VerifiablePresentation>;
/**
 * Verify a Verifiable Presentation: the presentation proof, then each
 * contained credential.
 *
 * SCOPE OF CLAIM.
 *   Establishes, when `valid` is true: the presentation and its proof
 *     configuration are unaltered since signing; the signing key is the one
 *     the DID in `holder` commits to; the proof was made for authentication;
 *     it carries the challenge and domain the caller expected, when the caller
 *     expected any; and every contained credential passes
 *     verifyVerifiableCredential.
 *   Does NOT establish: that the holder is entitled to present these
 *     credentials. A presentation binds the presenter to the bytes, not the
 *     credentials to the presenter; a holder presenting somebody else's
 *     credential produces a valid presentation of a valid credential, and the
 *     relying party has to compare the credential subject to the holder itself.
 *
 * `challenge` and `domain` are inside the signed bytes as of this change.
 * They used to be attached after signing, so a presentation minted for one
 * verifier could be readdressed to another without invalidating it.
 */
export declare function verifyVerifiablePresentation(vp: VerifiablePresentation, opts: {
    /** The nonce this verifier issued. REQUIRED, on the same terms as the twin
     *  in vc.ts: a presentation that answers no challenge answers any. */
    expectedChallenge: string;
    /** The domain this verifier expects to be addressed as. Optional. */
    expectedDomain?: string;
    /** Refuse unless the presentation claims this exact holder. Optional: the
     *  binding is checked either way and `holderDID` is returned. */
    expectedHolder?: string;
}): Promise<VPVerifyResult>;
//# sourceMappingURL=vc-wrapper.d.ts.map