import type { AuthorityDelegationV1 } from '../authority-delegation/types.js';
import type { AuthorityRevocationV1 } from './types.js';
/** Everything issuance takes besides the target delegation and the signing key. */
export interface AuthorityRevocationIssueInput {
    /** Canonical UTC-millisecond revocation time, supplied by the caller.
     *
     *  Issuance never reads a clock. The value lands in the record's signed `revoked_at`,
     *  so the same inputs produce the same bytes on every run, which is what makes the
     *  identifier and the signature reproducible in a test and in a conformance vector.
     *  Named `now` to match SubAuthorityIssueOptions. */
    now: string;
    /** The revoking authority. Checked against the target delegation's `issuer`. */
    revoker: string;
    /** Which key signs. A non-empty string; no local shape rule relates it to `revoker`.
     *  Whether it belongs to the issuer is decided only by key resolution against
     *  `target.issuer` at `revoked_at`, which verifyAuthorityRevocation() performs. */
    verification_method: string;
    /** Machine-readable reason. A non-empty string; the draft fixes no grammar. */
    reason_code: string;
    /** OPTIONAL. Omitted from the record entirely when not supplied; never written as null. */
    detail?: string;
    nonce: string;
}
/**
 * Mint a draft-03 section 3.5.1 direct revocation for one AuthorityDelegationV1.
 *
 * Section 3.5 line 634 states the only authorization rule this function applies: "Any
 * delegation MAY be revoked by its issuer." The exact comparison is
 * `input.revoker === delegation.issuer`, where `delegation` is the target record passed
 * in by the caller and `issuer` is its own member. The record being minted is never
 * consulted for its own authorization: a field a would-be revoker writes inside its own
 * record cannot make that revoker the issuer of somebody else's delegation.
 *
 * The target's `delegation_id` is recomputed from its body before that comparison. A
 * `delegation_id` sits outside the delegation's own identifier preimage, so a record
 * whose claimed identifier does not match its body has an unauthenticated `issuer` too,
 * and refusing there is what keeps the revoker check meaningful.
 *
 * What this function does NOT establish: that the holder of `privateKey` is in fact
 * `input.revoker`, or that `input.verification_method` is one of that party's keys. An
 * identifier-to-key binding is a resolver's answer, not a local one, and no string shape
 * imposed on `verification_method` here could stand in for it. verifyAuthorityRevocation()
 * makes that check, resolving the method under the TARGET delegation's `issuer` at
 * `revoked_at`. Issuance can only refuse to mint a record that is already unverifiable; it
 * cannot promise the record will verify.
 *
 * Nothing about a cascade over descendants is emitted here. This function produces one
 * record about one delegation. Enforcement against descendants comes from chain
 * verification, which rejects any chain containing a revoked ancestor.
 *
 * Throws on refusal; each message names its code in parentheses.
 */
export declare function issueAuthorityRevocation(delegation: AuthorityDelegationV1, input: AuthorityRevocationIssueInput, privateKey: string): AuthorityRevocationV1;
//# sourceMappingURL=issue.d.ts.map