import { type Attester } from './attestation.ts';
/** Where a verifying runtime leaves its verifier, for the plugin loader (`plugins.ts`) to find. */
export declare const VERIFIER: unique symbol;
/** What a host can ask of its plugins, in code: `use(scope, { verify: rules })`. */
export interface PluginRules {
    /** The sigstore identity plugins must be signed with. */
    identity?: string | undefined;
    /** The sigstore OIDC issuer plugins must be signed through. */
    issuer?: string | undefined;
    /** Attesters that must have vouched for each plugin, as `[kind@]did`. */
    attesters?: string[] | undefined;
    /** How many of them (default: all). */
    quorum?: number | undefined;
    /** DIDs whose bad verdict refuses a plugin. */
    block?: string[] | undefined;
    /** A certificate (PEM text, or a path to one) every plugin's chain must lead to. */
    ca?: string | undefined;
    /** Plugins pinned by package name to their whole-file hash; the loader hands each over as a `pin`. */
    pins?: Record<string, string> | undefined;
}
/**
 * What the plugin loader calls. Versioned, because the runtime and the copy of
 * the loader inside an app's bundle can be different releases.
 */
export interface PluginVerifier {
    readonly version: 1;
    /** True when a verifying runtime installed this: every plugin is verified, asked for or not. */
    readonly enforcing: boolean;
    /**
     * Verify a plugin and mount it — at `at`, the place another thread has it,
     * when that is given — or throw an error whose `reasons` say every way it
     * fell short. With `pin`, the plugin is held to that hash instead of to
     * the signers and attesters required of plugins.
     */
    mountPlugin(file: string, request: PluginRequest): {
        root: string;
    };
}
/** What the loader asks the verifier for. */
export interface PluginRequest {
    scope: string;
    rules?: PluginRules | undefined;
    /** Where to mount it. */
    at?: string | undefined;
    /** The whole-file hash the host pins it to, and who the refusal says pinned it. */
    pin?: {
        hash: string;
        by: string;
    } | undefined;
}
/** One group of attesters, all of which (or a quorum of which) must have vouched. */
export interface AttesterGroup {
    attesters: Attester[];
    quorum?: number | undefined;
}
/** What carries over from the runtime that verified the app to the plugins it loads. */
export interface Carried {
    /** The runtime would not mount an unsigned archive without attestations. */
    signature: boolean;
    groups: AttesterGroup[];
    block: Attester[];
    maxAge?: number | undefined;
    /** The sigstore trust root — the machine's, not the app's. */
    trustedRoot?: string | undefined;
}
/** Nothing carried over: a process that is not verifying, which asked to verify its plugins itself. */
export declare const NOTHING_CARRIED: Carried;
/**
 * A verifier. `enforcing` says a verifying runtime is behind it, so every
 * plugin is verified whether the host asked or not.
 */
export declare function verifier({ enforcing, carried }?: {
    enforcing?: boolean | undefined;
    carried?: Carried | undefined;
}): PluginVerifier & {
    readonly carried: Carried;
};
/**
 * What a verifying runtime calls once it is in place: from now on every
 * plugin this thread loads is verified, with `carried`. A second verifying
 * runtime in the same thread adds to what the first carried over.
 */
export declare function enforce(carried: Carried): void;
/**
 * What carries over from a runtime's settings: its attesters, its blocks, and
 * — when it names no attesters — that it requires a signature. Never its
 * signer identity, its issuer, its extra roots or `allowUntrusted`: those are
 * about the app's author.
 */
export declare function carriedFrom({ attesters, quorum, block, maxAge, trustedRoot }: {
    attesters: Attester[];
    quorum?: number | undefined;
    block: Attester[];
    maxAge?: number | undefined;
    trustedRoot?: string | undefined;
}): Carried;
/** The verifier the loader uses when the process is not verifying, and the host asked. */
export declare const pluginVerifier: PluginVerifier & {
    readonly carried: Carried;
};
//# sourceMappingURL=plugin-verifier.d.ts.map