/**
 * AgentGuard(TM) Spend: Signed hash-chained decision log
 *
 * Each policy decision is appended to a tamper-evident log:
 *   entry_n.previousHash = SHA-256(canonical_json(entry_{n-1} minus signature))
 *   entry_n.entryHash    = SHA-256(canonical_json(entry_n minus signature))
 *   entry_n.signature    = Ed25519(privateKey, entryHash)
 *
 * The log lives entirely in the customer runtime. The signing key never leaves
 * the customer environment. Public verification is performed by anyone with
 * the corresponding public key.
 *
 * The log structure (sequence number, previousHash binding, canonical-JSON
 * serialization, Ed25519 signature) is the subject of a U.S. provisional
 * patent application filed by the applicant in May 2026 (application number
 * pending). The log is also designed to interoperate with the DAG Trust
 * Attestation Token framework of Patent D §7.3 (App. No. 63/984,626) when
 * deployed in composition; such composition is not required for the
 * spend-governance functions implemented in this package.
 *
 * Patent notice: Protected by U.S. patent-pending technology
 * (App. Nos. 63/983,615; 63/983,621; 63/983,843; 63/984,626;
 * 64/071,781; 64/071,789).
 */
import type { SignedDecisionLogEntry, SpendDecision, DecisionLogStore } from './types';
/** All-zero hex string used as the previousHash of the genesis entry. */
export declare const GENESIS_PREVIOUS_HASH: string;
/**
 * Deterministic JSON serialization. Object keys are sorted, no trailing
 * whitespace, no NaN / Infinity. Required for stable hashing across runtimes.
 */
export declare function canonicalJson(value: unknown): string;
/** SHA-256 of a string, returned as lowercase hex. */
export declare function sha256Hex(input: string): string;
/**
 * Compute the entryHash for a decision and the previous hash.
 * This is the value that gets signed.
 */
export declare function computeEntryHash(args: {
    sequence: number;
    decision: SpendDecision;
    previousHash: string;
    signerFingerprint?: string;
    builderCode?: string;
}): string;
/**
 * Compute the public key fingerprint: first 8 bytes of SHA-256(pubkey), hex.
 * Used for short identification of which key signed an entry.
 */
export declare function computeSignerFingerprint(publicKey: Uint8Array): string;
/**
 * Sign a decision and produce a SignedDecisionLogEntry.
 *
 * The privateKey is a 32-byte Ed25519 secret seed. It MUST be generated and
 * stored by the customer; AgentGuard Spend never sees or transmits it.
 */
export declare function signDecision(args: {
    sequence: number;
    decision: SpendDecision;
    previousHash: string;
    privateKey: Uint8Array;
    publicKey: Uint8Array;
    builderCode?: string;
}): Promise<SignedDecisionLogEntry>;
/**
 * Verify a single entry's signature and hash. Returns true iff the entryHash
 * recomputes correctly AND the signature is valid for the given public key.
 *
 * Does NOT verify chain linkage (that's verifyChain's job).
 */
export declare function verifyEntry(entry: SignedDecisionLogEntry, publicKey: Uint8Array): Promise<boolean>;
/**
 * Verify an entire chain of decision log entries.
 *
 * Returns:
 *   { ok: true } if every entry is valid AND each entry's previousHash matches
 *     the prior entry's entryHash, AND the genesis entry has GENESIS_PREVIOUS_HASH,
 *     AND sequences are strictly increasing starting at 0.
 *   { ok: false, sequence, reason } on the first detected fault.
 */
export declare function verifyChain(entries: SignedDecisionLogEntry[], publicKey: Uint8Array): Promise<{
    ok: true;
} | {
    ok: false;
    sequence: number;
    reason: string;
}>;
/**
 * Completeness / sequence-gap detection.
 *
 * Each signed entry carries a monotonic per-signer (per-tenant) `sequence`
 * starting at 0. A missing sequence number between the lowest and highest
 * observed sequence is evidence that an action MAY have been taken around the
 * SDK and never logged (or that a logged entry was later deleted). This is a
 * DETECTION/REPORTING signal only — it never changes spend-cap enforcement.
 *
 * Returns the list of missing sequence numbers (gaps) for a single signer's
 * entries. Duplicate sequences are also surfaced (a duplicate implies the chain
 * was rewritten). Entries from multiple signers must be grouped by
 * `signerFingerprint` before calling this; mixed signers are treated as one
 * logical stream only if you have already filtered them.
 */
export interface SequenceGapReport {
    /** Sorted list of missing sequence numbers between min and max observed. */
    missing: number[];
    /** Sequence numbers that appeared more than once. */
    duplicates: number[];
    /** Lowest observed sequence, or null when there are no entries. */
    min: number | null;
    /** Highest observed sequence, or null when there are no entries. */
    max: number | null;
    /** Human-readable summary lines, e.g. "possible omitted actions: sequence gap at 4". */
    notes: string[];
}
export declare function detectSequenceGaps(entries: ReadonlyArray<Pick<SignedDecisionLogEntry, 'sequence'>>): SequenceGapReport;
/**
 * In-memory decision log store. Useful for tests, examples, and short-lived
 * shadow deployments. Production callers will typically supply their own
 * implementation that writes to a database table or append-only file.
 */
export declare class InMemoryDecisionLogStore implements DecisionLogStore {
    private entries;
    append(entry: SignedDecisionLogEntry): Promise<void>;
    getLatest(signerFingerprint?: string): Promise<SignedDecisionLogEntry | null>;
    read(fromSequence: number, limit: number, signerFingerprint?: string): Promise<SignedDecisionLogEntry[]>;
    /** Returns a defensive copy of all entries. Mainly for testing. */
    snapshot(): SignedDecisionLogEntry[];
}
//# sourceMappingURL=decision-log.d.ts.map