/**
 * SecureInvitation — Ed25519-bound invitation tokens.
 *
 * Spec Section 3.11: Challenge-bound invitation tokens that are:
 * - Cryptographically signed by the issuer's Ed25519 key
 * - Single-use (invalidated after redemption)
 * - Optionally bound to a specific recipient fingerprint
 * - Nonce-protected against replay
 * - Short-lived (default 1h, max 24h)
 */
export interface InvitationToken {
    version: 1;
    type: 'invitation';
    issuer: string;
    tokenId: string;
    nonce: string;
    scope: 'verified';
    expiry: string;
    maxUses: number;
    recipient?: string;
    submitHost?: string;
    submitCertFingerprint?: string;
    signature: string;
}
export interface Redemption {
    tokenId: string;
    redeemedBy: string;
    redeemedAt: string;
}
export declare class SecureInvitationManager {
    private redemptions;
    private revoked;
    private readonly stateFile;
    constructor(stateDir: string);
    /**
     * Create an Ed25519-signed invitation token.
     *
     * @param issuerFingerprint Fingerprint of the issuing agent
     * @param issuerPrivateKey Ed25519 private key (32 bytes)
     * @param options Optional: recipient binding, custom expiry, max uses
     */
    create(issuerFingerprint: string, issuerPrivateKey: Buffer, options?: {
        recipient?: string;
        expiryMs?: number;
        maxUses?: number;
        submitHost?: string;
        submitCertFingerprint?: string;
    }): InvitationToken;
    /**
     * Validate and optionally redeem an invitation token.
     *
     * Checks:
     * 1. Signature is valid (issuer's public key)
     * 2. Token is not expired
     * 3. Token is not revoked
     * 4. Token is not already redeemed (single-use)
     * 5. If recipient-bound: redeemer fingerprint matches
     * 6. Redeemer proves Ed25519 key possession (separate step)
     *
     * @param token The invitation token to validate
     * @param issuerPublicKey Ed25519 public key of the issuer (32 bytes)
     * @param redeemerFingerprint Fingerprint of the agent trying to redeem
     * @param redeem If true, mark as redeemed on successful validation
     */
    validate(token: InvitationToken, issuerPublicKey: Buffer, redeemerFingerprint: string, redeem?: boolean): {
        valid: boolean;
        reason: string;
    };
    /**
     * Revoke an unredeemed invitation token.
     */
    revoke(tokenId: string): boolean;
    /**
     * Check if a token has been redeemed.
     */
    isRedeemed(tokenId: string): boolean;
    private signToken;
    private verifyTokenSignature;
    private buildSignatureMessage;
    private saveState;
    private loadState;
}
//# sourceMappingURL=SecureInvitation.d.ts.map