export interface SpendMeta {
    intent?: string;
    payee?: string;
    amount?: string;
    currency?: string;
    toolName?: string;
}
export interface SpendAttestationContext {
    decisionAttestationId: string;
    paramsHash: string;
}
export interface AttestBeforeSpendOptions {
    apiKey: string;
    baseUrl?: string;
    agentId: string;
    mandateRef?: string;
    rail?: string;
    mode?: 'enforce' | 'log';
    attestReceipt?: boolean;
}
export interface AttestedSpendResult<T> {
    result: T;
    /** Canonical decision record. RETAIN THIS — the server stores only a
     *  commitment hash. Without this record the anchor is unverifiable. */
    decisionRecord: Record<string, unknown>;
    decisionCanonical: string;
    /** Commitment material — required to verify the anchor offline. */
    decisionPayloadKey?: string;
    decisionCommitment?: string;
    receiptRecord?: Record<string, unknown>;
    receiptCanonical?: string;
    decisionAttestationId: string;
    receiptAttestationId?: string;
    attestationError?: string;
}
export interface AttestAck {
    id: string;
    payloadKey?: string;
    payloadCommitment?: string;
}
/**
 * Recompute the server's salted commitment from the retained record.
 * salt = sha256(payloadKey + ':rubric-commit-v1')
 * commitment = sha256(salt + canonicalize(record))
 * Requires the payloadKey returned at attest time. Disclosing the derived
 * salt opens the commitment without revealing the decryption key.
 */
export declare function verifySpendCommitment(record: unknown, payloadKey: string, expectedCommitment: string): boolean;
export declare class AttestationGateError extends Error {
    constructor(msg: string);
}
export declare function attestBeforeSpend<TParams, TResult>(paymentFn: (params: TParams, ctx: SpendAttestationContext) => Promise<TResult>, opts: AttestBeforeSpendOptions): (params: TParams, meta?: SpendMeta) => Promise<AttestedSpendResult<TResult>>;
//# sourceMappingURL=attest-before-spend.d.ts.map