import type { Ed25519JWK, JWKS } from './types.js';
export interface ParsedDIDCycles {
    /** https JWKS endpoint the DID maps to. */
    jwksUrl: string;
    /** kid taken from the DID-URL fragment, if present. */
    kid?: string;
}
/**
 * Parse a did:cycles identifier (optionally with a #fragment) into its
 * JWKS URL and kid. Mirrors didWebToUrl: colon-separated segments,
 * each percent-decoded, segment[0] is the authority, the rest is the
 * path; a bare authority uses /.well-known/jwks.json.
 *
 * Throws on a structurally invalid did:cycles string. The fragment is
 * split off BEFORE segment parsing so a `#` never lands inside a path
 * segment.
 */
export declare function parseDIDCycles(did: string): ParsedDIDCycles;
/** True if the value looks like a did:cycles identifier. */
export declare function isDIDCycles(value: string): boolean;
export type JWKSelection = {
    ok: true;
    jwk: Ed25519JWK;
    publicKeyHex: string;
    kid?: string;
} | {
    ok: false;
    status: 'not_found' | 'ambiguous' | 'malformed';
    reason: string;
};
/**
 * Validate that a parsed object is a well-formed JWKS with a non-empty
 * `keys` array. Returns the JWKS on success or null on any structural
 * problem. Does NOT validate individual JWK key material; that happens
 * during candidate filtering / selection.
 */
export declare function asJWKS(body: unknown): JWKS | null;
/**
 * Select exactly one Ed25519 verification key from a JWKS by kid.
 *
 *  1. Filter to Ed25519 signing candidates.
 *  2. If a kid is requested: the candidate whose kid strictly equals it
 *     must be unique. Zero matches -> not_found. Duplicate kids ->
 *     ambiguous. kid comparison is exact, case-sensitive.
 *  3. If no kid is requested: exactly one candidate -> use it; more than
 *     one -> ambiguous; zero -> not_found.
 *  4. Decode `x` -> 32 bytes -> hex. A candidate that survives filtering
 *     but whose `x` is not 32 bytes is malformed.
 *
 * Never silently falls back to a different kid than requested.
 */
export declare function selectKey(jwks: JWKS, requestedKid?: string): JWKSelection;
//# sourceMappingURL=did-cycles.d.ts.map