import type { HybridPrivateKey, HybridPublicKey, PolicyVerdict, ProofBundle, VerificationReceipt, VerifierContext, VerifyResult } from "./types.js";
/**
 * BundleHash returns the canonical SHA-256 digest of a ProofBundle.
 *
 * Cross-SDK byte equivalence requires a fixed-shape signable: every field is
 * always present (no omitempty), keys are alphabetical at every level, and
 * empty bytes / empty lists / zero ints serialize as `""` / `[]` / `0`.
 * Every reference SDK (Go, TypeScript, Python, Rust) produces the same
 * 32-byte digest for the same logical bundle. Verified against fixtures
 * in `testvectors/v1/cross_sdk_vectors.json`.
 */
export declare function bundleHash(bundle: ProofBundle): Uint8Array;
export declare function verificationReceiptSignBytesBuf(r: VerificationReceipt): Uint8Array;
/**
 * Issue a verifier-signed VerificationReceipt over a (bundle, result, prev)
 * triple. `prev_hash` is 32 zero bytes for genesis.
 */
export declare function issueVerificationReceipt(bundle: ProofBundle, result: VerifyResult, verifierID: string, verifierPub: HybridPublicKey, verifierPriv: HybridPrivateKey, prevHash: Uint8Array | null, verifiedAt: number): Promise<VerificationReceipt>;
/**
 * Verify the hybrid signature on a VerificationReceipt against the
 * receipt's declared verifier_pub. Returns null iff both component sigs
 * verify; otherwise an error string.
 */
export declare function verifyVerificationReceipt(r: VerificationReceipt): Promise<string | null>;
/** SHA-256 of a receipt's signable bytes — use as `prev_hash` for the next. */
export declare function receiptHash(r: VerificationReceipt): Uint8Array;
/**
 * Canonical SHA-256 of the policy-relevant subset of a VerifierContext.
 * Used as `context_hash` on a PolicyVerdict so a verdict cached for one
 * context never accidentally applies to another.
 */
export declare function verifierContextHash(ctx: VerifierContext): Uint8Array;
export declare function policyVerdictSignBytesBuf(v: PolicyVerdict): Uint8Array;
/**
 * Issue an HMAC-bound PolicyVerdict. Typically called by a commercial
 * policy backend; `policySecret` MUST be cryptographically random and
 * private to the issuing service.
 */
export declare function issuePolicyVerdict(verdictID: string, agentID: string, scope: string, allow: boolean, contextHash: Uint8Array, issuedAt: number, validUntil: number, policySecret: Uint8Array): PolicyVerdict;
/**
 * Check a PolicyVerdict's HMAC and validity. Returns null iff:
 *   - MAC matches `policySecret`
 *   - within [issued_at, valid_until] at `now`
 *   - agent_id / scope / context_hash match the caller's expectation
 *   - allow == true
 *
 * Returns `"policy_verdict_denied: ..."` when the MAC is valid but
 * `allow == false` (explicit cached deny).
 */
export declare function verifyPolicyVerdict(v: PolicyVerdict, policySecret: Uint8Array, expectedAgentID: string, expectedScope: string, expectedContextHash: Uint8Array, now: number): string | null;
//# sourceMappingURL=receipts.d.ts.map