import type { Account } from "@keetanetwork/keetanet-client/lib/account.js";
import type { ResolvedCertificateChainRequirement } from "../utils/certificate-network.js";
import type { Signable } from "../utils/signing.js";
export type ExtractOk<T> = Omit<Extract<T, {
    ok: true;
}>, 'ok'>;
export type HTTPSignedField = {
    nonce: string;
    timestamp: string;
    signature: string;
};
export declare const assertHTTPSignedField: (input: unknown) => HTTPSignedField;
export interface HTTPSignedFieldURLParameters {
    signedField: HTTPSignedField;
    account: Account;
}
export declare function addSignatureToURL(input: URL | string, data: HTTPSignedFieldURLParameters): URL;
export declare function parseSignatureFromURL(input: URL | string): Partial<HTTPSignedFieldURLParameters>;
/**
 * Verify a signed body, then enforce the cert-chain gate. Returns the
 * authenticated account. Throws `KeetaAnchorUserError` on missing or
 * invalid auth, and `KeetaAnchorCertificateRequiredError` when the
 * caller's on-chain cert chain doesn't satisfy `certificateChain`.
 */
export declare function verifyBodyAuth<T extends {
    account?: string;
    signed?: unknown;
}>(request: T, getSigningData: (req: T) => Signable, certificateChain?: ResolvedCertificateChainRequirement): Promise<Account>;
/**
 * Verify a URL-signed request, then enforce the cert-chain gate. Returns
 * the authenticated account. The signable is built by the caller from a
 * request derived from the URL-bound account public key.
 */
export declare function verifyURLAuth(url: URL | string, getSigningData: (account: Account) => Signable, certificateChain?: ResolvedCertificateChainRequirement): Promise<Account>;
//# sourceMappingURL=common.d.ts.map