/**
 * Trusted Ledger Mutation & Validation Contexts.
 *
 * Implements the structural in-process capability boundary for the
 * Mission Contract and Requirement Ledger system, plus a trusted
 * validation registry for authoritative ledger replay.
 *
 * Mutation context: OPAQUE, BRANDED, SEPARATE — not serializable, not reconstructible.
 * Validation context: contains a trust registry for replay verification.
 *
 * This is NOT a cryptographic identity system. It is a structural boundary
 * that prevents serialized payloads from inventing authority, and prevents
 * stored provenance from self-authenticating.
 */
import type { EvidenceAuthorityClassification, EvidenceCollectorType, MissionContractV1 } from "./types.js";
/**
 * Verifiable principal identity classification.
 *
 * These are stored as provenance in the ledger for auditing.
 * They do NOT directly grant capabilities — capability sets are
 * assigned by the trusted factory separately.
 */
export type TrustedPrincipalKind = "agent" | "operator" | "trusted-collector" | "automated-review" | "system";
export type LedgerCapability = "evidence:repository-observation" | "evidence:command-result" | "evidence:test-result" | "evidence:runtime-observation" | "evidence:operator-confirmation" | "evidence:trusted-collector" | "transition:satisfy" | "transition:not-applicable" | "transition:operator-override" | "execution:complete";
export type EvidenceLedgerCapability = Extract<LedgerCapability, "evidence:repository-observation" | "evidence:command-result" | "evidence:test-result" | "evidence:runtime-observation" | "evidence:operator-confirmation" | "evidence:trusted-collector">;
export declare function isEvidenceCapability(cap: string): cap is EvidenceLedgerCapability;
/**
 * A trusted evidence-source grant binds a source identifier to:
 *   - An exact principal tuple (principalId + principalKind)
 *   - An evidence capability
 *   - Optional constraints on evidence type, collector class,
 *     requirement IDs, and criterion IDs.
 *
 * Sources are explicit grants, not derived from principal IDs.
 * A registered principal is NOT automatically a source.
 */
export interface TrustedEvidenceSourceGrant {
    readonly sourceId: string;
    /** The exact principal tuple that may use this source. */
    readonly principalId: string;
    readonly principalKind: TrustedPrincipalKind;
    /** The evidence capability this source is authorized under. */
    readonly capability: EvidenceLedgerCapability;
    /** Allowed evidence types. Must be non-empty. */
    readonly allowedEvidenceTypes: readonly string[];
    /** Optional collector class restrictions. */
    readonly allowedCollectorClasses?: readonly string[];
    /** Optional requirement ID restrictions. */
    readonly allowedRequirementIds?: readonly string[];
    /** Optional criterion ID restrictions. */
    readonly allowedCriterionIds?: readonly string[];
}
export interface TrustedLedgerMutationContext {
    readonly principalId: string;
    readonly principalKind: TrustedPrincipalKind;
    readonly capabilities: ReadonlySet<LedgerCapability>;
}
/**
 * Source verification request carrying all available dimensions.
 */
export interface EvidenceSourceVerificationRequest {
    readonly sourceId: string;
    readonly principalId: string;
    readonly principalKind: TrustedPrincipalKind;
    readonly capability: string;
    readonly evidenceType: string;
    readonly collectorClass?: EvidenceCollectorType;
    readonly requirementIds: readonly string[];
    readonly criterionIds: readonly string[];
}
/**
 * Trusted validation context for authoritative ledger replay.
 *
 * Contains a registry of known principals and their capabilities,
 * plus explicit trusted evidence-source grants.
 * During validation, every stored verifiedPrincipalId, verifiedPrincipalKind,
 * and verifiedCapability is checked against this registry.
 * Stored provenance is NOT self-authenticating.
 *
 * This context is not serializable, not reconstructible from ledger JSON,
 * and not derivable from stored verified fields.
 */
export interface TrustedValidationContext {
    /**
     * Verify that a principal exists and has the claimed kind.
     */
    verifyPrincipal(principalId: string, principalKind: string): boolean;
    /**
     * Verify that a principal was granted a specific capability.
     * Requires exact (principalId, principalKind) match.
     */
    verifyCapability(principalId: string, principalKind: string, capability: string): boolean;
    /**
     * Verify an evidence source against its trusted grant.
     * Checks source existence, principal binding, capability, evidence type,
     * and optional collector/requirement/criterion constraints.
     */
    verifyEvidenceSource(request: EvidenceSourceVerificationRequest): boolean;
}
/**
 * The default untrusted context used by the generic CLI and
 * any caller that does not hold a trusted capability grant.
 */
export declare function getUntrustedContext(): TrustedLedgerMutationContext;
/**
 * @deprecated Use inspectRequirementLedgerStructure() or inspectLedgerStructure()
 * for structural inspection. This function returns a structural-only object that
 * does NOT implement TrustedValidationContext and cannot be passed to
 * authoritative validation APIs.
 *
 * Will be removed when all callers have migrated to the structural API.
 */
export declare function getUntrustedValidationContext(): TrustedValidationContext;
/**
 * Returns true when the value was created by _internalCreateTrustedContext
 * or getUntrustedContext. Plain objects, JSON round-trips, and Object.assign
 * copies will always return false.
 */
export declare function isTrustedMutationContext(ctx: unknown): ctx is TrustedLedgerMutationContext;
/**
 * Returns true when the value was created by the internal validation
 * context factory or getUntrustedValidationContext.
 */
export declare function isTrustedValidationContext(ctx: unknown): ctx is TrustedValidationContext;
export declare function _internalCreateTrustedContext(params: {
    principalId: string;
    principalKind: TrustedPrincipalKind;
    capabilities: LedgerCapability[];
}): TrustedLedgerMutationContext;
/**
 * Create a trusted validation context from a set of known principals
 * and explicit trusted evidence-source grants, bound to one validated Mission Contract.
 *
 * THIS IS THE TRUST-MINTING BOUNDARY: every genuine TrustedValidationContext
 * is bound to exactly one Mission Contract digest. The factory itself:
 *   1. Validates the Mission Contract.
 *   2. Derives the authoritative canonical contract digest.
 *   3. Builds immutable requirement and criterion registries from the validated contract.
 *   4. Validates every source-grant requirement and criterion reference.
 *   5. Rejects invalid or ambiguous grants.
 *   6. Binds the resulting genuine validation context to that exact contract digest.
 *   7. Returns no usable trusted context on failure.
 *
 * Principals are identified by exact (id, kind) tuples with associated capabilities.
 * During replay, stored provenance is verified against this registry.
 *
 * Duplicate exact principal tuples are REJECTED.
 *
 * Same textual ID with different kinds is PERMITTED, but each tuple is treated
 * as completely independent. No capability sharing across kinds.
 *
 * Source IDs require explicit TrustedEvidenceSourceGrant entries.
 * Registered principals are NOT automatically sources.
 *
 * Standalone validators (validateSourceGrantCriterionIds) are diagnostic
 * conveniences. This factory is the mandatory enforcement boundary.
 *
 * @deprecated The legacy two-argument form (principals, sourceGrants) is no
 * longer supported for trusted context creation. Use the params-object form
 * with a contract parameter instead.
 */
export declare function _internalCreateTrustedValidationContext(paramsOrContract: {
    contract: MissionContractV1;
    principals: Array<{
        principalId: string;
        principalKind: TrustedPrincipalKind;
        capabilities: LedgerCapability[];
    }>;
    sourceGrants?: TrustedEvidenceSourceGrant[];
} | Array<{
    principalId: string;
    principalKind: TrustedPrincipalKind;
    capabilities: LedgerCapability[];
}>): TrustedValidationContext;
export declare function _internalCreateTrustedValidationContext(principals: Array<{
    principalId: string;
    principalKind: TrustedPrincipalKind;
    capabilities: LedgerCapability[];
}>, sourceGrants?: TrustedEvidenceSourceGrant[]): TrustedValidationContext;
/**
 * Retrieve the contract digest bound to a TrustedValidationContext.
 *
 * Returns undefined when the object is not a genuine trusted context.
 * This is an internal function — not exposed through the public API index.
 */
export declare function _getBoundContractDigest(ctx: TrustedValidationContext): string | undefined;
export declare function contextHasCapability(ctx: TrustedLedgerMutationContext, capability: LedgerCapability): boolean;
export declare function contextHasAnyCapability(ctx: TrustedLedgerMutationContext, capabilities: LedgerCapability[]): boolean;
export declare function capabilityToAuthority(capability: LedgerCapability): EvidenceAuthorityClassification | undefined;
export declare function deriveEffectiveAuthority(ctx: TrustedLedgerMutationContext, evidenceType: string): EvidenceAuthorityClassification;
/**
 * Returns true when a non-empty source is required for the given evidence
 * and authority context. A missing/empty source must fail closed.
 */
export declare function isSourceRequiredForEvidence(params: {
    effectiveAuthority: EvidenceAuthorityClassification;
    contractAuthoritativeSources?: readonly EvidenceAuthorityClassification[];
    criterionRequiredEvidence?: {
        allowedTypes?: string[];
        minAuthority?: EvidenceAuthorityClassification;
        requiredCollectorClass?: string;
        minPassingStatus?: "pass";
    };
}): boolean;
//# sourceMappingURL=trusted-context.d.ts.map