/**
 * AgentGuard(TM) Spend: External timestamp anchoring.
 *
 * The signed decision log proves *internal* order and integrity: each entry
 * binds the previous entry's hash and is Ed25519-signed. But those signatures
 * are produced inside the operator's own environment, so on their own they
 * cannot prove the chain was not re-generated (backdated / reordered) later.
 *
 * A `TimestampAnchor` closes that gap by binding the chain head's SHA-256 to an
 * EXTERNAL clock: a public timestamp calendar (e.g. OpenTimestamps -> Bitcoin).
 * After anchoring, "this hash existed no later than <time>" is provable to a
 * third party who trusts the external calendar, not the operator.
 *
 * ZERO DATA PLANE: an anchor submits ONLY the 32-byte SHA-256 digest of the
 * chain head (or a Merkle root over the ndjson chain). A hash reveals nothing
 * about prompts, completions, keys, amounts, or model identity. No decision
 * content, no policy, no scope, and no key material ever leaves the process.
 *
 * This is a design point of Patent D (external timestamp anchoring of the
 * signed receipt chain).
 *
 * Patent notice: Protected by U.S. patent-pending technology
 * (App. Nos. 63/983,615; 63/983,621; 63/983,843; 63/984,626;
 * 64/071,781; 64/071,789).
 */
/** Anchor lifecycle. `pending` = submitted to a calendar but the external
 *  (e.g. Bitcoin) attestation is not yet confirmed/upgraded. `complete` = an
 *  external attested time is available. `invalid` = the proof does not bind the
 *  supplied head hash, or is malformed. */
export type AnchorStatus = 'pending' | 'complete' | 'invalid';
/**
 * A stored anchor proof. Opaque `proof` bytes (base64) are the calendar's
 * response — the shape is anchor-implementation-specific (for OpenTimestamps it
 * is the serialized .ots timestamp). Everything here is metadata about a HASH;
 * it carries no decision content.
 */
export interface AnchorProof {
    version: 1;
    /** Anchor implementation that produced this proof, e.g. "opentimestamps". */
    anchorType: string;
    /** The lowercase-hex SHA-256 that was anchored (chain head or Merkle root). */
    headHashHex: string;
    /** ISO 8601 time the digest was submitted (operator-local; NOT the attested time). */
    submittedAt: string;
    /** Base64 of the opaque proof bytes returned by the calendar. Empty when stubbed. */
    proof: string;
    status: AnchorStatus;
    /** Calendar endpoints the digest was submitted to. */
    calendars?: string[];
    /**
     * Attested time, once known. Only set by a REAL upgrade of the proof against
     * the external clock (never fabricated). `null` while pending.
     */
    attestedAt?: string | null;
    /** Free-text note, e.g. that the OTS wire protocol is stubbed pending the dep. */
    note?: string;
}
export interface AnchorVerification {
    /** True iff the proof binds `headHashHex` AND a calendar receipt/attestation is present. */
    ok: boolean;
    status: AnchorStatus;
    /**
     * The externally attested time when `status === 'complete'`, otherwise the
     * submission time for a pending proof, otherwise null. Callers should treat a
     * non-null `when` as authoritative ONLY when `status === 'complete'`.
     */
    when: string | null;
    /** Whether `when` is backed by the external clock (true) or just submission (false). */
    attested: boolean;
    detail?: string;
}
/**
 * Pluggable external timestamp anchor.
 *
 * `anchor(headHashHex)` submits the digest and returns a storable proof.
 * `verify(headHashHex, proof)` re-checks that the proof binds the head hash and
 * reports the attested time (or pending status).
 */
export interface TimestampAnchor {
    readonly type: string;
    anchor(headHashHex: string): Promise<AnchorProof>;
    verify(headHashHex: string, proof: AnchorProof): Promise<AnchorVerification>;
}
//# sourceMappingURL=types.d.ts.map