/**
 * DEC-099 — SysML v2 interop S3 (spec §4, DEC-081). Verify that an envelope's
 * embedded `H2ASysmlRef` is (a) signed by the claimed actor — **commit-trust**,
 * the default: a valid signature over an immutable commit is enough — and
 * optionally (b) **content-integrity**: re-fetch the element (S2) and check its
 * canonical hash against the `elementHash` embedded at sign time, catching a
 * repository that violated immutability or a wrong `apiBase`.
 */
import { type H2AEnvelope, type H2ASysmlRef } from "@sentropic/h2a";
import { type SysmlFetchImpl } from "./client.js";
/** Extract the ref from the conventional location `body.subject.sysmlRef` (spec §2). */
export declare function extractSysmlRef(envelope: H2AEnvelope): H2ASysmlRef | undefined;
export interface VerifyEnvelopeSysmlOptions {
    /** Public key to verify the envelope signature against (commit-trust). */
    readonly publicKeyPem: string;
    /** Only accept a signature from this signer id. */
    readonly by?: string;
    /** Also re-fetch + re-hash the element and compare to `ref.elementHash`. */
    readonly contentIntegrity?: boolean;
    readonly apiBase?: string;
    readonly auth?: string;
    readonly fetchImpl?: SysmlFetchImpl;
}
export interface VerifyEnvelopeSysmlResult {
    readonly ok: boolean;
    readonly ref?: H2ASysmlRef;
    readonly signatureVerified: boolean;
    readonly contentVerified?: boolean;
    readonly reason?: string;
}
export declare function verifyEnvelopeSysmlRef(envelope: H2AEnvelope, options: VerifyEnvelopeSysmlOptions): Promise<VerifyEnvelopeSysmlResult>;
//# sourceMappingURL=verify.d.ts.map