import { type Attester } from './attestation.ts';
import { BundleProvider } from './bundle-provider.ts';
export { BundleProvider };
export declare const EXTENSION = ".nzip";
export interface ProviderOptions {
    /** File suffixes claimed outright (default: ['.nzip']). */
    extensions?: string[] | undefined;
    /**
     * Also claim any file carrying our signature marker, whatever it is named
     * (default: true). This is what keeps a renamed archive from falling
     * through to the built-in ZIP provider, which checks nothing.
     */
    claimSigned?: boolean | undefined;
    /**
     * Also claim any file that is a ZIP at all, whatever it is called, and
     * refuse it for want of a signature unless attestations vouch for it
     * (default: true).
     *
     * Without this, an unsigned archive mounts *unverified* through the
     * built-in provider while this one is registered, which reads as a pass.
     * With it, registering this provider means exactly one thing: nothing
     * mounts unless it verifies.
     */
    claimArchives?: boolean | undefined;
    /**
     * Extra trusted roots, as PEM text or paths to PEM files (default: the
     * `BUNDLE_ROOTS` environment variable, a path-delimiter-separated list).
     */
    roots?: string[] | undefined;
    /**
     * Accept a good signature whose chain is not anchored in the trust store
     * (default: the `BUNDLE_ALLOW_UNTRUSTED` environment variable).
     */
    allowUntrusted?: boolean | undefined;
    /**
     * Recompute every member digest at mount instead of on fetch
     * (default: false — fetches check them anyway).
     */
    deep?: boolean | undefined;
    /** Require this sigstore signing identity (default: `BUNDLE_IDENTITY`). */
    identity?: string | undefined;
    /** Require this sigstore OIDC issuer (default: `BUNDLE_ISSUER`). */
    issuer?: string | undefined;
    /** Path to the sigstore trust root (default: `BUNDLE_SIGSTORE_ROOT`). */
    trustedRoot?: string | undefined;
    /**
     * Require attestations from these attesters, as `[kind@]did` (default:
     * `BUNDLE_ATTESTERS`). Checked against the attestation cache only — a
     * mount does not reach for the network.
     */
    attesters?: string[] | undefined;
    /** How many of `attesters` must have attested (default: `BUNDLE_QUORUM`, else all). */
    quorum?: number | undefined;
    /** DIDs whose bad verdict refuses an archive (default: `BUNDLE_BLOCK`). */
    block?: string[] | undefined;
    /** Milliseconds a cached proof stays good for (default: `BUNDLE_ATTESTATION_MAX_AGE`, else seven days). */
    maxAge?: number | undefined;
    /** Identifier reported in diagnostics (default: 'bundle'). */
    name?: string | undefined;
}
export interface Settings {
    [kSettings]: true;
    name: string;
    extensions: string[];
    claimSigned: boolean;
    claimArchives: boolean;
    extraRoots: string[];
    allowUntrusted: boolean;
    deep: boolean;
    identity: string | undefined;
    issuer: string | undefined;
    trustedRoot: string | undefined;
    attesters: Attester[];
    quorum: number | undefined;
    maxAge: number | undefined;
    block: Attester[];
}
/**
 * Verify `path` and return a provider that serves it, or throw. `options` are
 * the same as `register()`'s.
 */
export declare function open(path: string, options?: ProviderOptions | Settings): BundleProvider;
/**
 * Register this provider with `node:vfs` so the `--vfs-load` startup flag
 * selects it for signed archives. Meant to be preloaded, before `--vfs-load`
 * picks a provider:
 *
 *   node --experimental-vfs -r @pipobscure/bundle/register --vfs-load=app.nzip
 */
export declare function register(options?: ProviderOptions): Settings;
declare const kSettings: unique symbol;
/** `options` with every default filled in from the environment, as `open()` and `register()` use them. */
export declare function settings(options?: ProviderOptions | Settings): Settings;
//# sourceMappingURL=provider.d.ts.map