import { type DidDocument, type Value } from './repo.ts';
/** The record type, and the collection attestations live in. */
export declare const COLLECTION = "com.pipobscure.bundle.attestation";
/** How old a cached proof may be before it no longer counts (seven days). */
export declare const DEFAULT_MAX_AGE: number;
/** One required attester: a DID, and optionally the kind of claim it must make. */
export interface Attester {
    did: string;
    kind?: string | undefined;
}
/** What a verification demands of attestations. */
export interface AttestationPolicy {
    attesters: Attester[];
    /** How many of `attesters` must have attested (default: all of them). */
    quorum?: number | undefined;
    /** Milliseconds a cached proof stays good for (default: seven days). */
    maxAge?: number | undefined;
    /** Attesters whose bad verdict refuses the archive outright. */
    block?: Attester[] | undefined;
    /** The cache directory (default: `cacheDir()`). */
    cache?: string | undefined;
}
/** What an attestation says of the bytes: vouched for, or warned against. */
export type Verdict = 'good' | 'bad';
/** What was found for one required attester. */
export interface Attestation {
    did: string;
    /** The kind the policy required, if it required one. */
    kind?: string | undefined;
    /** The handle the DID document claims — for display only. */
    handle?: string | undefined;
    /** Whether this attester's requirement is met. */
    ok: boolean;
    reason: string;
    /** The kind the record declares. */
    attested?: string | undefined;
    /** Good unless the record says otherwise. */
    verdict?: Verdict | undefined;
    /** When the attester says they made it. */
    createdAt?: string | undefined;
    /** When this machine last confirmed the record was there. */
    checkedAt?: Date | undefined;
    /** The record's address. */
    uri: string;
    /** The attester's own words about it, when the record carries any: shown, never decisive. */
    note?: string | undefined;
    /** A post the attester links for context, when the record names one: shown, never decisive. */
    post?: StrongRef | undefined;
}
/** A reference to one version of a record: its address, and its CID. */
export interface StrongRef {
    uri: string;
    cid: string;
}
/** The outcome of checking a policy against the cache. */
export interface AttestationOutcome {
    met: boolean;
    /** How many attesters had to be satisfied. */
    required: number;
    attestations: Attestation[];
    /** Bad verdicts from blocking attesters; any of these refuses the archive. */
    blocked: Attestation[];
    reason: string;
}
/** The record as it is written. */
export interface AttestationRecord {
    $type: typeof COLLECTION;
    /** `<alg>:<hex>` — the whole-file hash. */
    hash: string;
    kind?: string | undefined;
    /** Absent means good. */
    verdict?: Verdict | undefined;
    /** Context, in the attester's own words. */
    note?: string | undefined;
    /** A post that gives the context. */
    post?: StrongRef | undefined;
    createdAt: string;
}
/** The longest note the lexicon allows: 300 graphemes, and 3000 bytes. */
export declare const NOTE_GRAPHEMES = 300;
export declare const NOTE_BYTES = 3000;
/** Why `note` is too long for an attestation, or undefined when it fits. */
export declare function noteTooLong(note: string): string | undefined;
/**
 * Where a person opens the post `uri` names: a post of the Atmosphere's
 * microblog (`app.bsky.feed.post`) on the web, as anyone would link it; any
 * other record by its `at://` address.
 */
export declare function postUrl(uri: string): string;
/** A DID this module can resolve: `did:plc:` or a hostname `did:web:`. */
export declare const DID_PATTERN = "^did:(?:plc:[a-z2-7]{24}|web:[A-Za-z0-9.%-]+)$";
/** An attestation kind: `audited`, `malware`, … */
export declare const KIND_PATTERN = "^[A-Za-z0-9._-]+$";
/** `[kind@]did`. */
export declare const ATTESTER_PATTERN: string;
/** `90s`, `30m`, `12h`, `7d`, or a bare number of seconds. */
export declare const DURATION_PATTERN = "^\\s*(\\d+(?:\\.\\d+)?)\\s*(s|m|h|d)?\\s*$";
/**
 * Parse `[kind@]<did or handle>`. A DID and a handle can both appear here; only
 * a DID can be verified against, so a caller that has the network resolves a
 * handle with `atproto.resolveAttester()` before the policy is used.
 */
export declare function parseAttester(spec: string): {
    subject: string;
    kind?: string | undefined;
};
/** The inverse of `parseAttester`, for a resolved attester. */
export declare function formatAttester({ did, kind }: Attester): string;
/** Whether `text` is a DID this module can resolve: `did:plc:` or `did:web:`. */
export declare function isDid(text: string): boolean;
/** Parse attesters that must already be DIDs — what comes from the environment or a baked policy. */
export declare function attestersFrom(specs: string[] | undefined): Attester[];
/**
 * A duration: `90s`, `30m`, `12h`, `7d`, or a bare number of seconds. Returns
 * milliseconds.
 */
export declare function parseDuration(text: string): number;
/**
 * The policy the environment describes, for the preload, which takes no
 * arguments: `BUNDLE_ATTESTERS` (space- or comma-separated `[kind@]did`),
 * `BUNDLE_QUORUM`, `BUNDLE_ATTESTATION_MAX_AGE`, and `BUNDLE_BLOCK` (DIDs whose
 * bad verdict refuses an archive).
 */
export declare function policyFromEnvironment(env?: NodeJS.ProcessEnv): Omit<AttestationPolicy, 'cache'>;
/**
 * Where this tool keeps state: the install record, and the attestation cache
 * beside it. Per-user, and outside anything a bundle can write to — or
 * `state` under `BUNDLE_ROOT`, for a layout of its own (see scopes.ts).
 */
export declare function stateDir(): string;
/** The attestation cache: `BUNDLE_ATTESTATIONS`, else `attestations/` in `stateDir()`. */
export declare function cacheDir(): string;
/** A cached proof: the CAR, and when it was last confirmed. */
export interface CachedProof {
    checkedAt: Date;
    car: Buffer;
}
/** The DID document cached for `did`, or null. */
export declare function readDocument(cache: string, did: string): DidDocument | null;
export declare function writeDocument(cache: string, doc: DidDocument): void;
/**
 * The repository head — the latest commit's CID — at which the cache last
 * held everything `did` had attested, or null. While the repository is still
 * there, nothing it attested has changed, and nothing needs fetching.
 */
export declare function readHead(cache: string, did: string): string | null;
export declare function writeHead(cache: string, did: string, commit: string): void;
/** The cached proof for `did`'s record at `rkey`, or null. */
export declare function readProof(cache: string, did: string, rkey: string): CachedProof | null;
export declare function writeProof(cache: string, did: string, rkey: string, proof: CachedProof): void;
export declare function removeProof(cache: string, did: string, rkey: string): void;
/** The record keys `did` has cached proofs for. */
export declare function cachedKeys(cache: string, did: string): string[];
/** Every DID the cache holds a proof from for record key `rkey` — whoever has said anything about that hash. */
export declare function cachedFor(rkey: string, cache?: string): string[];
/** Every DID the cache holds anything for. */
export declare function cachedDids(cache?: string): string[];
/** The `at://` address of `did`'s attestation of `hex`. */
export declare function recordUri(did: string, hex: string): string;
/**
 * What a verified proof's record says about `hashAlg:hex`, or why it does not
 * count. Shared by the cache check and by whatever fetched the proof.
 */
export declare function readRecord(value: Value, hashAlg: string, hex: string): {
    ok: true;
    record: AttestationRecord;
} | {
    ok: false;
    reason: string;
};
/**
 * Check a policy against the cache, for an archive whose whole-file hash is
 * `hashAlg:hex`. Synchronous, and offline: what is not in the cache is not
 * there.
 */
export declare function evaluate(policy: AttestationPolicy, hashAlg: string, hex: string, now?: number): AttestationOutcome;
/**
 * Every attestation of `hashAlg:hex` the cache holds from `did`, good or bad,
 * verified — or null when there is none, or it is not fresh. What install and
 * update show a person, rather than what a policy demands.
 */
export declare function cached(did: string, hashAlg: string, hex: string, { cache, maxAge, now }?: {
    cache?: string | undefined;
    maxAge?: number | undefined;
    now?: number | undefined;
}): Attestation | null;
//# sourceMappingURL=attestation.d.ts.map