import { EventEmitter } from "../../agent/EventEmitter.mjs";
import { MdocRepository } from "./repository/MdocRepository.mjs";
import { MdocVerificationSessionRecord } from "./repository/MdocVerificationSessionRecord.mjs";
import { MdocVerificationSessionRepository } from "./repository/MdocVerificationSessionRepository.mjs";
import "./repository/index.mjs";
import { MdocDcApiCreateResponseOptions, MdocDcApiCreateVerificationSessionOptions, MdocDcApiResolveRequestOptions, MdocDcApiResolvedRequest, MdocDcApiVerifyResponseOptions } from "./MdocOptions.mjs";
import { MdocDeviceResponse } from "./MdocDeviceResponse.mjs";
import { AgentContext } from "../../agent/context/AgentContext.mjs";
import "../../agent/index.mjs";
import { IsoMdocDcApiRequest, IsoMdocDcApiResponse } from "@owf/mdoc";
//#region src/modules/mdoc/MdocDcApiService.d.ts
/**
 * Verifier and wallet APIs for the ISO/IEC TS 18013-7:2025 Annex C (`org-iso-mdoc`) DC API.
 *
 * @internal
 */
export declare class MdocDcApiService {
  private mdocRepository;
  private mdocVerificationSessionRepository;
  private eventEmitter;
  constructor(mdocRepository: MdocRepository, mdocVerificationSessionRepository: MdocVerificationSessionRepository, eventEmitter: EventEmitter);
  /**
   * Create an `org-iso-mdoc` request (verifier side) and persist a verification session for it.
   *
   * The origin is not part of the request payload; it only enters the protocol through the session
   * transcript. It therefore has to be supplied again to {@link MdocDcApiService.verifyResponse},
   * except that a `readerAuth` request signs over the transcript and is fixed to the origin it is
   * created for.
   */
  createVerificationSession(agentContext: AgentContext, options: MdocDcApiCreateVerificationSessionOptions): Promise<{
    verificationSession: MdocVerificationSessionRecord;
    request: IsoMdocDcApiRequest;
  }>;
  /**
   * Decrypt and verify an `org-iso-mdoc` response (verifier side).
   *
   * The response is bound to the origin through the session transcript, so decryption only succeeds
   * for the origin the wallet actually used. That is what makes a response relayed from another
   * origin fail.
   */
  verifyResponse(agentContext: AgentContext, options: MdocDcApiVerifyResponseOptions): Promise<{
    verificationSession: MdocVerificationSessionRecord;
    deviceResponse: MdocDeviceResponse;
    deviceRequestMatch: import("@owf/mdoc").DeviceRequestMatchSuccess;
    origin: string;
  }>;
  /**
   * Resolve the trusted certificates for a single mdoc in a device response.
   *
   * Same resolution order as the other credential verification paths: the global
   * `getTrustedIssuersForVerification` callback first, then the deprecated
   * `getTrustedCertificatesForVerification` callback, and only if neither returns anything the
   * statically configured trusted certificates. Both callbacks receive the certificate chain of
   * the mdoc being verified, so trust can be decided per document.
   */
  private getTrustedCertificatesForMdoc;
  /**
   * Assert the reader certificate chain of a single doc request is trusted.
   *
   * Same resolution order as the issuer trust in {@link MdocDcApiService.getTrustedCertificatesForMdoc}:
   * the certificates passed to `resolveRequest` first, then the global
   * `getTrustedIssuersForVerification` callback, then the deprecated
   * `getTrustedCertificatesForVerification` callback, and only if none of these return anything
   * the statically configured trusted certificates.
   *
   * As everywhere else x509 signers are verified, resolving nothing is not a reason to continue
   * without establishing trust: the reader certificate chain is signed by the reader itself, so
   * skipping the chain check would leave the reader identity self-asserted. A wallet that wants to
   * decide on the reader identity itself can return the leaf certificate from the callback, which
   * trusts the reader on the certificate it presented.
   */
  private assertTrustedReaderCertificateChain;
  /**
   * Parse an incoming `org-iso-mdoc` request (wallet side) and match it against stored mdocs.
   *
   * `origin` must be the origin provided by the platform; Annex C C.5 requires the mdoc to abort
   * when no origin was received.
   */
  resolveRequest(agentContext: AgentContext, options: MdocDcApiResolveRequestOptions): Promise<MdocDcApiResolvedRequest>;
  /**
   * Fetch the stored mdocs for the requested doctypes.
   *
   * Only the requested doctypes are fetched, as a wallet can hold many more mdocs than a request
   * covers. The issuer-signed CBOR of each record is decoded once, and matched against every doc
   * request from there.
   *
   * Records that cannot provide an instance for `useMode` are left out, as creating a response with
   * them would throw.
   */
  private getCandidates;
  /**
   * Create the encrypted `org-iso-mdoc` response (wallet side).
   */
  createResponse(agentContext: AgentContext, options: MdocDcApiCreateResponseOptions): Promise<IsoMdocDcApiResponse>;
  private updateState;
  private emitStateChangedEvent;
}
//#endregion
//# sourceMappingURL=MdocDcApiService.d.mts.map