/**
 * TOKEN-mode chain-receipt verification for deployGate.
 *
 * SDK 3.4.0 `CodeRifts.verifyReceipt` is HTTP POST /api/v1/verify-receipt (async, I/O) —
 * unusable inside the pure deployGate. Local public-material verify of crchain.v1 is
 * NOT exported by that SDK. This module:
 *   - uses node:crypto Ed25519 the same way `@coderifts/sdk` `verifyExecutionAttestation` does
 *     (`createPublicKey` + `verify`) — no new algorithm
 *   - reuses SDK `ExecutorKeyRegistry` shape and `isReceiptExpired` (ID104 leeway)
 *   - reuses this package's `computeBodyHash` for envelope bind
 *   - reconstructs the published crchain.v1 signing input (RECEIPT_FORMAT / app kernel)
 *
 * No fetch. Same inputs → same output.
 */
import { type NextAgentStep } from './next-agent-step.js';
import type { ExecutorKeyRegistry } from '@coderifts/sdk';
/** Structural receipt view produced after TOKEN verify (assignable to DeployReceiptView). */
export type TokenDerivedReceiptView = {
    currently_authorized: boolean;
    decision: string;
    execution_action?: string;
    operation?: string;
    bound_environment?: string | null;
    bound_artifact_id?: string | null;
    verdict_fingerprint?: string;
    body_hash?: string;
    target_id?: string;
    /**
     * I-1288f — the decision's own remediation suggestion, lifted from the envelope.
     * Only ever populated by viewFromEnvelope, which runs after the body hash bound.
     * `fail()` returns `view: null`, so no unverified token can produce one.
     */
    next_agent_step?: NextAgentStep | null;
};
export declare const CHAIN_SIGNING_PREFIX = "crchain.v1";
export type DeployTokenReceipt = {
    /** Signed chain_receipt token (`base64url(body).base64url(sig)`). */
    token: string;
    /** Body-hash-bound decision envelope (verifier family). Required for currently_authorized. */
    decision_result?: Record<string, unknown>;
    /** Well-known-shaped registry `{ keys: [{ kid, public_key_pem, status, valid_from, retired_at }] }`. */
    registry?: ExecutorKeyRegistry;
    /** Air-gap single PEM (kid-agnostic). */
    pinnedKeyPem?: string;
};
export type DeployTokenVerifyStatus = 'VERIFIED_CURRENT' | 'VERIFIED_EXPIRED' | 'RETIRED_KEY_VALID_AT_ISSUE' | 'INVALID_SIGNATURE' | 'MALFORMED' | 'UNKNOWN_KEY' | 'UNSUPPORTED_VERSION' | 'KEY_REVOKED' | 'REVOKED_KEY' | 'REVOKED_KEY_UNDECIDABLE' | 'KEY_RETIRED_AFTER_SIGNING' | 'UNKNOWN_KEY_STATUS';
export type DeployTokenVerifyResult = {
    valid: boolean;
    status: DeployTokenVerifyStatus;
    currently_authorized: boolean;
    authz_reason: string | null;
    /** When set, deployGate denies with this reason before bind checks. */
    denyReason: string | null;
    payload?: Record<string, unknown>;
    view: TokenDerivedReceiptView | null;
    key_status: 'active' | 'retired' | 'revoked' | 'unknown' | null;
};
/**
 * Verify a chain-receipt token against a registry or pinned PEM. Pure (no I/O).
 */
export declare function verifyDeployReceiptToken(input: DeployTokenReceipt, _intended?: {
    operation?: string;
    environment?: string;
    artifact_id?: string;
}, nowMs?: number): DeployTokenVerifyResult;
//# sourceMappingURL=deploy-receipt-token.d.ts.map