import type { KeyLocator } from '../key-resolution/types.js';
/** The convention path. A did:web domain serves this static document. */
export declare const WELL_KNOWN_APS_AGENTS_PATH: '/.well-known/aps-agents.json';
export declare const APS_AGENTS_DOC_SPEC_VERSION: '1.0';
/** One published agent issuer entry. Carries enough for a relying party
 *  to construct a TrustedIssuer + PinnedKey for its policy. The pinned
 *  bytes are authoritative; the locator is how to confirm them live. */
export interface ApsAgentEntry {
    /** Issuer identity (DID or stable id). */
    issuer_id: string;
    display_name: string;
    /** 64-char lowercase hex Ed25519 public keys this issuer signs with.
     *  These are the bytes a relying party SHOULD pin. */
    pubkeys_hex: string[];
    /** Optional M3 locator (DID or JWKS URL) to resolve/confirm the keys.
     *  Reuses the KeyLocator shape unchanged. */
    locator?: KeyLocator;
    /** Optional binding constraints (exact / prefix-glob) the issuer's
     *  certs are expected to satisfy. */
    binding_constraints?: string[];
}
/** The published document. Static, cacheable, no signature requirement
 *  at the convention layer: trust is anchored by the SIGNED policy a
 *  relying party builds from this, plus the live key resolution. The
 *  document MAY itself be hosted under a did:web domain whose did.json is
 *  separately signed/resolvable. */
export interface ApsAgentsDoc {
    spec_version: typeof APS_AGENTS_DOC_SPEC_VERSION;
    /** The domain (or did:web id) this document describes. */
    domain: string;
    /** When the document was generated (unix ms). */
    generated_at: number;
    agents: ApsAgentEntry[];
}
export interface GenerateApsAgentsInput {
    domain: string;
    generated_at: number;
    agents: ApsAgentEntry[];
}
/** Pure generator: validate the entries and produce the document object.
 *  No network, no filesystem; the caller serializes and publishes. */
export declare function generateApsAgentsDoc(input: GenerateApsAgentsInput): ApsAgentsDoc;
/** Compose the HTTPS URL for a domain's aps-agents document, reusing the
 *  did:web host/port encoding so it sits beside did.json under identical
 *  host rules.
 *
 *   apsAgentsUrl('example.com')        → https://example.com/.well-known/aps-agents.json
 *   apsAgentsUrl('did:web:example.com')→ https://example.com/.well-known/aps-agents.json
 *   apsAgentsUrl('did:web:host%3A8443')→ https://host:8443/.well-known/aps-agents.json
 *
 *  A bare domain is treated as did:web:<domain> for encoding purposes. */
export declare function apsAgentsUrl(domainOrDidWeb: string): string;
//# sourceMappingURL=well-known.d.ts.map