/**
 * Pure verifier — TS mirror of `gateway/auth/go/verify.go`. Takes a
 * macaroon (either base64url-encoded or already parsed), the trusting
 * org's policy, and a clock; returns `Claims` or throws a
 * `VerifyError` with a machine-readable `code`.
 *
 * No I/O. No revocation list. Adapters wrap this with their own
 * revocation + transport plumbing.
 */
import type { Claims, Macaroon, Policy } from "./types.js";
export type VerifyErrorCode = "macaroon_malformed" | "macaroon_unsupported_version" | "invalid_user_authorization" | "user_authorization_expired" | "invalid_invocation_signature" | "invocation_violated" | "ua_per_invocation_exceeded" | "macaroon_expired" | "attenuation_invalid" | "attenuation_widened";
export declare class VerifyError extends Error {
    readonly code: VerifyErrorCode;
    constructor(code: VerifyErrorCode, message?: string);
}
/**
 * Verify a macaroon end-to-end.
 *
 * @param macaroon either the base64url-encoded wire form or a parsed object
 * @param policy   the trusted org's pubkey or multisig policy
 * @param now      the verifier's current time
 */
export declare function verify(macaroon: string | Macaroon, policy: Policy, now: Date): Claims;
export declare function decodeMacaroon(b64url: string): Macaroon;
export declare function encodeMacaroon(m: Macaroon): string;
//# sourceMappingURL=verify.d.ts.map