import { type Attester } from './attestation.ts';
export { SCOPE_PATTERN, isScope } from './scopes.ts';
export declare const FILE_KEYS: string[];
export declare const RULE_KEYS: string[];
export declare const REQUIRE_KEYS: string[];
export declare const TRUST_KEYS: string[];
export declare const SIGNER_KEYS: string[];
/** A SHA-256 certificate fingerprint, as `node:crypto` prints one. */
export declare const FINGERPRINT_PATTERN = "^([0-9A-Fa-f]{2}:){31}[0-9A-Fa-f]{2}$";
/** Where discovery may point. */
export declare const DISCOVERY_PATTERN = "^https?://";
/**
 * Where the JSON Schema for policy files is published: attached to each GitHub
 * release, so a file can name the schema of the version that wrote it.
 * `version` absent means the latest release's.
 */
export declare function schemaUrl(version?: string | undefined): string;
/** A policy file's text, with `$schema` first, pointing at `version`'s schema. */
export declare function formatPolicyFile(file: PolicyFile, version: string): string;
/**
 * A policy file to start from: nothing required, nothing trusted, every section
 * present so an editor offers what goes in each.
 */
export declare function starterPolicy(): PolicyFile;
/** The public backlink index attestations are discovered through. */
export declare const DEFAULT_DISCOVERY = "https://constellation.microcosm.blue";
/** A sigstore signer: an identity, through an issuer. */
export interface Signer {
    identity: string;
    issuer: string;
}
/** The rules one section of a policy file may give. */
export interface Rules {
    require?: {
        /** The archive must carry a signature that verifies (from an accepted issuer). */
        signature?: boolean | undefined;
        /** An update must be signed through the same issuer as the version it replaces. */
        sameIssuer?: boolean | undefined;
        /** Attesters that must have vouched, as `[kind@]did`. */
        attesters?: string[] | undefined;
        /** How many of them (default: all). */
        quorum?: number | undefined;
    } | undefined;
    /** The only OIDC issuers whose signatures count. */
    issuers?: string[] | undefined;
    trust?: {
        signers?: Signer[] | undefined;
        /** `[kind@]did`: attestations accepted without asking. */
        attesters?: string[] | undefined;
        /** SHA-256 fingerprints of certificate-chain roots accepted without asking. */
        certificates?: string[] | undefined;
    } | undefined;
    /** DIDs whose bad verdict refuses an archive. */
    block?: string[] | undefined;
    /** DIDs whose verdicts, good or bad, are not shown or counted. */
    ignore?: string[] | undefined;
}
/** A policy file. */
export interface PolicyFile extends Rules {
    /** Where attestations are discovered, or false not to look. */
    discovery?: string | false | undefined;
    /** How stale a cached attestation proof may be, as a duration. */
    maxAge?: string | undefined;
    apps?: Record<string, Rules> | undefined;
    /** Rules for the plugins installed for one app, by its package name. */
    scopes?: Record<string, Rules> | undefined;
}
/** An attestation requirement, and where it came from. */
export interface AttesterClause {
    attesters: Attester[];
    quorum?: number | undefined;
    source: string;
}
/** Everything in force for one install, from every source. */
export interface Policy {
    /** The files that were read. */
    files: string[];
    /** Where a signature was required, if anywhere. */
    signature: string[];
    /** Where same-issuer updates were required, if anywhere. */
    sameIssuer: string[];
    attesters: AttesterClause[];
    /** Each source's list of acceptable issuers; a signature must be in every one. */
    issuers: {
        list: string[];
        source: string;
    }[];
    trust: {
        signers: Signer[];
        attesters: Attester[];
        certificates: string[];
    };
    block: Attester[];
    ignore: string[];
    discovery: string | false;
    maxAge?: number | undefined;
}
/** An empty policy: nothing required, nothing trusted, discovery on. */
export declare function emptyPolicy(): Policy;
/** The machine-wide policy file (`BUNDLE_SYSTEM_POLICY` overrides it). */
export declare function systemPolicyPath(): string;
/** The user's policy file (`BUNDLE_POLICY` overrides it). */
export declare function userPolicyPath(): string;
/**
 * The policy in force for `app` (an installed name), or the global one: the
 * system file, then the user's, each with its `apps[app]` section.
 *
 * With `scope`, it is the policy for a plugin installed for that app instead:
 * the global rules and each file's `scopes[scope]` section — never the app's
 * own `apps` section, which is about the app's author, not the plugin's. With
 * `global: false` as well, only the scope's sections: what a plugin is checked
 * against when it is loaded, on top of what the runtime carries over.
 */
export declare function loadPolicy(app?: string | undefined, { scope, global }?: {
    scope?: string | undefined;
    global?: boolean | undefined;
}): Policy;
/** Read and check one policy file; null when there is none. */
export declare function readPolicyFile(path: string): PolicyFile | null;
//# sourceMappingURL=policy.d.ts.map