/**
 * Delegation-as-Claim skeleton — agent authorization via Claim Algebra.
 *
 * Implements the delegation operator from §3 of
 * `vauban-privacy-protocol/docs/research/03-agentic-privacy.md`.
 *
 * A DelegationClaim records that a parent Claim (held by a human or another agent)
 * authorizes a delegatee pseudonym to act within a bounded scope and time window.
 *
 * The full ZK proof of delegation (STARK proof walking the chain) is out of scope
 * for this TypeScript slice. This module provides the data structures and builder
 * so the agent SDK can produce delegation-compatible payloads for future proof
 * generation (handled by the Rust HDNT crate).
 *
 * @module privacy/delegation
 */
/**
 * Minimal Claim reference (digest + optional algorithm tag).
 * Structurally compatible with `ClaimRef` from the `@vauban/claim` package.
 */
export interface ClaimRef {
    /** SHA-256 or Poseidon-felt252 digest of the parent Claim, as byte array. */
    digest: number[];
    /** Hash algorithm used for the digest. Defaults to "sha-256". */
    "digest-alg"?: "sha-256" | "poseidon-felt252";
}
/**
 * Scope of actions the delegatee is authorized to perform.
 *
 * - `allowedActions`: action-type identifiers the agent may produce N_action for.
 *   Use `["*"]` for unrestricted delegation (max_depth enforcement still applies).
 * - `expiry`: Unix timestamp (seconds) after which this delegation is invalid.
 */
export interface DelegationScope {
    allowedActions: string[];
    expiry: number;
}
/**
 * Delegation Claim produced by `buildDelegationClaim`.
 *
 * Wire-compatible with the Claim Algebra composition record
 * (`operator: "delegation"`) from `@vauban-org/claim`.
 */
export interface DelegationClaim {
    /** Reference to the parent Claim that grants authority. */
    parentClaim: ClaimRef;
    /** Pseudonym (felt252 BigInt as hex string) of the delegatee agent. */
    delegateePseudonym: string;
    /** Authorized scope for the delegatee. */
    scope: DelegationScope;
    /** ISO-8601 timestamp of claim issuance. */
    issuedAt: string;
    /** Serialized scope for inclusion in a STARK proof witness. */
    scopeWitness: string;
}
/**
 * Serialize a DelegationScope to a deterministic JSON witness string.
 * Keys are sorted (JCS-compatible) for reproducibility in proof circuits.
 */
export declare function serializeDelegationScope(scope: DelegationScope): string;
/**
 * Return true if the scope is still valid at the given Unix timestamp.
 *
 * @param scope - DelegationScope to check.
 * @param nowSec - Current time in Unix seconds. Defaults to `Date.now() / 1000`.
 */
export declare function isDelegationScopeValid(scope: DelegationScope, nowSec?: number): boolean;
/**
 * Return true if the given action type is permitted by the scope.
 *
 * `["*"]` grants permission to all action types (wildcard).
 */
export declare function isActionAllowed(scope: DelegationScope, actionType: string): boolean;
/**
 * Build a DelegationClaim from a parent ClaimRef, delegatee pseudonym, and scope.
 *
 * The returned object is a proof-ready payload. The STARK proof of correct
 * delegation (proving the delegation chain without revealing identity) is
 * generated by the Rust HDNT crate from this payload.
 *
 * @param parentClaim       - ClaimRef of the root or intermediate claim granting authority.
 * @param delegateePseudonym - Agent nullifier (felt252 BigInt) for the delegatee.
 * @param scope             - Authorized action scope and expiry.
 * @returns DelegationClaim ready for proof generation.
 */
export declare function buildDelegationClaim(parentClaim: ClaimRef, delegateePseudonym: bigint, scope: DelegationScope): DelegationClaim;
//# sourceMappingURL=delegation.d.ts.map