/**
 * @module receipt-verifier
 * @description Verifies an execution receipt (`mandaitor.execution-receipt/v1`):
 * Mandaitor's signed statement of what became of an execution.
 *
 * A receipt is the proof of an outcome, as a Proof-of-Mandate is the proof of
 * an authorization. It is a compact JWS, PS256, signed with a key of its own
 * that only Mandaitor's executor holds, and published in the issuer's DID
 * document as `#receipt-key-1`. A token is a receipt only when its `typ`,
 * `contract` and key all say so: a PoM, or anything signed with the PoM key,
 * is refused, and so is a receipt presented as a PoM by
 * {@link verifyProofOfMandate}, which requires `vct` and `exp`.
 *
 * @example
 * ```ts
 * import { verifyReceiptForExecution } from "@mandaitor/sdk";
 *
 * const execution = await executions.getExecution("exe_…");
 * const result = await verifyReceiptForExecution(execution, {
 *   allowedIssuers: ["did:web:api.mandaitor.io:v1"],
 * });
 * if (result.valid) console.log(result.claims.state, result.claims.target);
 * ```
 */
import type { DidDocument } from "./pom-verifier.js";
export declare const EXECUTION_RECEIPT_CONTRACT = "mandaitor.execution-receipt/v1";
export declare const EXECUTION_RECEIPT_TYP = "mandaitor-receipt+jwt";
/** The receipt key's fragment in the issuer's DID document. */
export declare const EXECUTION_RECEIPT_KEY_FRAGMENT = "receipt-key-1";
/** The claims of an execution receipt, as Mandaitor's executor signs them. */
export interface ExecutionReceiptClaims {
    /** The issuer's DID. */
    iss: string;
    iat: number;
    /** `rct_` and a ULID. */
    jti: string;
    /** The agent's DID. */
    sub: string;
    contract: typeof EXECUTION_RECEIPT_CONTRACT;
    tenant_id: string;
    execution_id: string;
    state: "SUCCEEDED" | "FAILED";
    tool: {
        id: string;
        version: number;
    };
    request_digest: string;
    /** The approval the execution was dispatched on, when a person approved it. */
    approval?: {
        consent_id: string;
        digest: string;
        decided_by: string;
        decided_at: string;
    };
    /** The dispatch event, the mandate it relied on, and the digest of the PoM that event carries. */
    authorization: {
        event_id: string;
        mandate_id: string;
        pom_digest: string;
    };
    target: {
        connector_id: string;
        /** The connector's type, e.g. `sap-s4hana`. */
        system: string;
        record: string;
        version_before: string;
        version_after?: string;
        /** The target's own reference for the write, where it has one. */
        transaction_ref?: string;
    };
    timeline: {
        decided_at: string;
        dispatched_at: string;
        completed_at: string;
    };
    /** In SUCCEEDED: the digest of the result the agent was given. */
    result_digest?: string;
}
/** What a receipt must say, for the execution it came with. Every field is optional. */
export interface ReceiptExpectation {
    execution_id?: string;
    request_digest?: string;
    state?: "SUCCEEDED" | "FAILED";
    /** The agent's DID. */
    agent_did?: string;
    tenant_id?: string;
    /**
     * The result the execution was answered with. The receipt's `result_digest`
     * must be its digest, so the receipt binds what the agent was told.
     */
    result?: Record<string, unknown>;
}
/** Options for {@link verifyExecutionReceipt}. */
export interface ReceiptVerifyOptions {
    /**
     * Issuer DIDs to accept, exactly. Checked before any DID is resolved, so a
     * receipt naming another issuer never causes a request. Strongly recommended.
     */
    allowedIssuers?: string[];
    /** Resolves the issuer's DID document; defaults to `did:web` over HTTPS. */
    didResolver?: (did: string) => Promise<DidDocument | null>;
    expected?: ReceiptExpectation;
    /** Clock skew tolerance for `iat`, in seconds (default 60). */
    clockSkewSeconds?: number;
    /** The current time, in Unix seconds, for testing. */
    currentTime?: number;
}
export interface ReceiptVerificationResult {
    valid: boolean;
    /** The decoded claims, for inspection even when invalid; null when undecodable. */
    claims: Partial<ExecutionReceiptClaims> | null;
    /** Each problem found; empty when valid. */
    errors: string[];
}
/**
 * Verifies an execution receipt: that it is a receipt and nothing else, that
 * the issuer's receipt key signed it, that its claims are complete, and that
 * it says what `options.expected` says.
 */
export declare function verifyExecutionReceipt(token: string, options?: ReceiptVerifyOptions): Promise<ReceiptVerificationResult>;
/**
 * Verifies the receipt an execution was answered with, against the execution
 * itself: its id, request digest, state and, in SUCCEEDED, its result.
 * Invalid when the execution carries no receipt.
 */
export declare function verifyReceiptForExecution(execution: {
    execution_id: string;
    request_digest: string;
    state: string;
    result: Record<string, unknown> | null;
    receipt: string | null;
}, options?: Omit<ReceiptVerifyOptions, "expected"> & {
    expected?: Pick<ReceiptExpectation, "agent_did" | "tenant_id">;
}): Promise<ReceiptVerificationResult>;
//# sourceMappingURL=receipt-verifier.d.ts.map