import type { VerificationKeyResolver } from '../authority-delegation/types.js';
import type { AuthorityRevocationVerificationResult } from './types.js';
export interface AuthorityRevocationVerificationOptions {
    /** Resolves the key that signed the revocation, selected at the revocation's own
     *  `revoked_at`, per draft section 2.4: the key current at verification time is not
     *  necessarily the one that signed this record. */
    resolveVerificationKey: VerificationKeyResolver;
}
/**
 * Verify one draft-03 section 3.5.1 direct revocation against the delegation it names.
 *
 * A revocation is never judged alone. Whether a record is a revocation of THIS delegation
 * and whether its signer was allowed to revoke are both questions about the target, so the
 * target is a required argument and every authorization fact is read from it.
 *
 * Checks, in order, returning at the first that fails:
 *
 *  1. closed schema and canonical values on the revocation
 *  2. `cascade_transaction_id` recomputes from the record's own origin content
 *  3. `revocation_id` recomputes from the record's own body
 *  4. closed schema and canonical values on the target delegation
 *  5. the target's `delegation_id` recomputes from the target's own body
 *  6. the revocation's `delegation_id` equals the target's
 *  7. the revocation's `revoker` equals the TARGET's `issuer` (draft section 3.5)
 *  8. the revoker's key resolves, at the revocation's `revoked_at`
 *  9. the Ed25519 signature verifies over the domain-tagged preimage
 *
 * Step 8 hands the resolver `target.issuer`, read from the target delegation, not the
 * `revoker` the record carries. The two are equal by step 7, and reading the target's
 * member is what makes the authorization external to the record: no field inside a
 * revocation selects the key that authorizes it.
 *
 * Fails closed. Anything unrecognized, any resolver that throws, any shape this schema
 * does not claim, produces invalid, indeterminate or unsupported, never valid. This
 * function does not throw.
 */
export declare function verifyAuthorityRevocation(candidate: unknown, delegation: unknown, options: AuthorityRevocationVerificationOptions): AuthorityRevocationVerificationResult;
//# sourceMappingURL=verify.d.ts.map