import * as CRYPTO from 'node:crypto';
import type { Signer } from './archive.ts';
import type * as SigstoreSpecs from '@sigstore/protobuf-specs';
export declare const DEFAULT_FULCIO_URL = "https://fulcio.sigstore.dev";
export declare const DEFAULT_REKOR_URL = "https://rekor.sigstore.dev";
/** A base URL: `@sigstore/sign` appends `/api/v1/timestamp` itself. */
export declare const DEFAULT_TSA_URL = "https://timestamp.sigstore.dev";
export declare const DEFAULT_TUF_MIRROR = "https://tuf-repo-cdn.sigstore.dev";
/** The comment field the sigstore bundle travels in. */
export declare const FIELD = "SIGSTORE";
/** Where a trust root came from, so a caller can say how fresh it is. */
export type TrustedRootOrigin = 'explicit' | 'environment' | 'cache' | 'seed';
export interface TrustedRootLocation {
    origin: TrustedRootOrigin;
    /** The file it was read from, or the seed's mirror key. */
    path: string;
}
export interface SigstoreIdentity {
    subject?: string | undefined;
    issuer?: string | undefined;
    /** GitHub Actions tokens name the workflow that ran. */
    workflow?: string | undefined;
}
export interface SigstoreSignerOptions {
    /** An OIDC token to use instead of signing in. */
    token?: string | undefined;
    flow?: 'auto' | 'ci' | 'browser' | 'device' | undefined;
    /** OIDC issuer (default: sigstore's Dex). */
    issuer?: string | undefined;
    /** Dex connector to jump to (default: 'github'). */
    connector?: string | undefined;
    fulcioURL?: string | undefined;
    /** Transparency log; '' to skip. */
    rekorURL?: string | undefined;
    /** RFC 3161 timestamp authority; '' to skip. */
    tsaURL?: string | undefined;
    /** Digest the signature uses (default: 'sha256'). */
    signAlg?: string | undefined;
    log?: ((line: string) => void) | undefined;
}
/** A sigstore-backed `Signer`, with the identity it authenticated as. */
export interface SigstoreSigner extends Signer {
    kind: 'sigstore';
    identity: SigstoreIdentity;
}
export interface BundleVerification {
    identity?: string | undefined;
    issuer?: string | undefined;
    signedAt?: Date | undefined;
}
/** Whether the sigstore libraries needed for *verification* are loadable. */
export declare function available(): boolean;
/**
 * Phase one: authenticate, mint an ephemeral keypair, and get a Fulcio
 * certificate for it. Returns a signer whose `chain` can go straight into
 * `AUTHORITY.PEM` and whose `sign()` finishes the job once the hash exists.
 */
export declare function signer(options?: SigstoreSignerOptions): Promise<SigstoreSigner>;
/**
 * Verify a sigstore bundle over `artifact` (the whole-file hash bytes) and
 * return the identity it establishes. Synchronous, because the mount path is:
 * `provider.ts` decides whether to serve an archive before any of the program
 * in it runs, and cannot await.
 *
 * Throws on a bundle that does not verify. `trustedRoot` must be supplied —
 * this deliberately does not reach for the network.
 */
export declare function verifyBundle(encoded: string, artifact: Buffer, { trustedRoot, identity, issuer }: {
    trustedRoot: SigstoreSpecs.TrustedRoot;
    identity?: string | undefined;
    issuer?: string | undefined;
}): BundleVerification;
/**
 * The leaf certificate a sigstore bundle carries, as an X509Certificate — so a
 * verifier can confirm the inspectable `AUTHORITY.PEM` names the same
 * certificate the bundle was actually verified against.
 */
export declare function bundleCertificate(encoded: string): CRYPTO.X509Certificate | null;
/**
 * Where the sigstore trust root would be read from, in the order tried:
 * an explicit path, `BUNDLE_SIGSTORE_ROOT`, the cache `bundle trust` maintains,
 * and finally the seed `@sigstore/tuf` ships. Returns null when none exists.
 *
 * The seed is the fallback rather than the first choice because it is frozen at
 * the version of the library that was installed; `bundle trust` fetches the
 * live one over TUF and that copy wins whenever it is present.
 */
export declare function trustedRootLocation(source?: string | undefined): TrustedRootLocation | null;
/**
 * Load the sigstore trust root synchronously. Returns null when there is none —
 * verification then reports that as a reason rather than failing, because
 * "I could not check" and "this is forged" are different answers.
 */
export declare function trustedRootSync(source?: string | undefined): SigstoreSpecs.TrustedRoot | null;
/**
 * Refresh the trust root over the network, through TUF — signed metadata with
 * its own root of trust, not a plain download. Returns the cache path.
 */
export declare function refreshTrustedRoot({ mirror, force }?: {
    mirror?: string | undefined;
    force?: boolean | undefined;
}): Promise<string>;
/**
 * Where `@sigstore/tuf` keeps the target it downloaded. Mirrors its own
 * `appDataPath()` so the two agree without depending on a private export.
 */
export declare function cachedRootPath(mirror?: string): string;
/**
 * A policy string that matches `value` and nothing else, for a verifier that
 * reads its policy as a regular expression.
 */
export declare function exactly(value: string): string;
//# sourceMappingURL=sigstore.d.ts.map