import { type VerifyEthosResult } from "./ethos.js";
import { type Sphere } from "./did.js";
export interface BundleVerifyResult extends VerifyEthosResult {
    bundle_id?: string;
    edition?: {
        version: string;
        height: number;
    };
    subject_handle?: string;
    zones_skipped: Sphere[];
}
/**
 * Optional knobs for {@link verifyBundleAtPath}.
 *
 * `resolveDelegatePubkey` lets a caller (typically `aithos ethos install` or a
 * keystore-aware verifier) resolve `authorized_by` references on the zone or
 * manifest signature to the delegate's raw Ed25519 public key. The pure
 * stateless caller — a stranger verifying a bundle on a fresh machine — has
 * no such resolver and so will fail closed on delegate-signed bundles.
 */
export interface BundleVerifyOpts {
    resolveDelegatePubkey?: (keyId: string, mandateId: string) => Uint8Array;
}
/**
 * Verify a bundle at a filesystem path. `pathArg` may be either:
 *   - a directory containing the flat unpacked layout, or
 *   - a `.ethos` zip file (any extension is accepted — detection is by header).
 *
 * Stateless by default: does not touch `~/.aithos/`, does not require any
 * sealed seed. Encrypted zones have their content checks recorded as
 * `skipped`. Callers that DO have local state (e.g. installed mandates) can
 * pass `opts.resolveDelegatePubkey` to enable verification of delegate-signed
 * bundles.
 *
 * The caller should distinguish exit codes:
 *   - ok=true  → exit 0 (valid; may have warnings)
 *   - ok=false → exit 1 (parsed but invalid signatures / chains)
 *   - exceptions thrown → exit 2 (unparseable; caller wraps)
 */
export declare function verifyBundleAtPath(pathArg: string, opts?: BundleVerifyOpts): BundleVerifyResult;
/** Pretty one-line description for log output. */
export declare function describeBundle(dir: string): string;