import type { ActionIntent, PolicyDecision, EpistemicClaims } from './types/policy.js';
import type { Delegation, ActionReceipt } from './types/passport.js';
/** Canonical predicate identifier for the in-toto Decision Receipt v0.1.
 *  Matches the emission on the Hermes-APS delegation Python side. */
export declare const DECISION_RECEIPT_PREDICATE_TYPE: "https://veritasacta.com/attestation/decision-receipt/v0.1";
/** in-toto Statement envelope type. */
export declare const INTOTO_STATEMENT_V1: "https://in-toto.io/Statement/v1";
/** DSSE payloadType for in-toto Statements. */
export declare const INTOTO_PAYLOAD_TYPE: "application/vnd.in-toto+json";
export interface IntotoResourceDescriptor {
    name: string;
    digest: {
        sha256: string;
    };
}
export interface DecisionReceiptPredicate {
    decision: 'permit' | 'deny' | 'narrow';
    reason: string;
    policyId: string;
    policyDigest: {
        sha256: string;
    };
    /** SHA-256 hex of the JCS canonicalization of the full delegation chain. */
    delegationChainRoot: {
        sha256: string;
    };
    /** Hops from the root principal to the acting agent. */
    delegationDepth: number;
    /** Typed epistemic labels — see PolicyReceipt.epistemic_claims. */
    epistemicClaims: EpistemicClaims;
    issuerId: string;
    issuedAt: string;
    /** Digest of the ActionIntent the decision is attesting. */
    intentDigest: {
        sha256: string;
    };
    /** Digest of the ActionReceipt that witnessed the executed effect. */
    receiptDigest: {
        sha256: string;
    };
    metadata: {
        framework: 'aps';
        receiptKind: 'decision_receipt';
        apsVersion: string;
        actionRef?: string;
        [key: string]: unknown;
    };
}
export interface IntotoStatement {
    _type: typeof INTOTO_STATEMENT_V1;
    predicateType: typeof DECISION_RECEIPT_PREDICATE_TYPE;
    subject: IntotoResourceDescriptor[];
    predicate: DecisionReceiptPredicate;
}
export interface DSSESignature {
    keyid: string;
    sig: string;
}
/** DSSE-style signed envelope returned by emitDecisionReceipt.
 *  Verifies with @veritasacta/verify (Apache-2.0) and composes with
 *  the Python emission in aeoess/hermes-aps-delegation. */
export interface DecisionReceiptEnvelope {
    payloadType: typeof INTOTO_PAYLOAD_TYPE;
    payload: string;
    signatures: DSSESignature[];
    /** Convenience field (not part of DSSE) — SHA-256 of the payload bytes.
     *  Lets callers chain envelopes without re-canonicalizing. */
    _digest: {
        sha256: string;
    };
}
export interface EmitDecisionReceiptInput {
    /** The agent's signed request. */
    intent: ActionIntent;
    /** The evaluator's signed verdict. */
    decision: PolicyDecision;
    /** The acting agent's signed receipt of what actually happened. */
    receipt: ActionReceipt;
    /** Ordered root-to-leaf delegation chain that authorized the action.
     *  delegation_chain_root is SHA-256(JCS(chain)); delegation_depth is chain.length. */
    delegationChain: Delegation[];
    /** Typed epistemic labels the emitter asserts for this receipt. */
    epistemicClaims: EpistemicClaims;
    /** Policy identifier (e.g. 'floor-validator-v1'). */
    policyId: string;
    /** Ed25519 private key (hex) of the signer. */
    signerPrivateKey: string;
    /** Stable identifier for the signing key. Defaults to `ed25519:<first-16-hex>`
     *  derived from the public key when not supplied. */
    signerKeyId: string;
    /** Issuer DID or stable identifier for the signing party. */
    issuerId: string;
    /** APS version string. Defaults to '2.3.0-alpha'. */
    apsVersion?: string;
}
/** Compute the delegation chain root digest used by v2.3 bilateral receipts.
 *  Deterministic across re-emissions: SHA-256 of the JCS serialization of the
 *  chain array. Exported so verifiers and cross-repo implementations (e.g. the
 *  Python hermes-aps-delegation emitter) can reproduce it byte-for-byte. */
export declare function computeDelegationChainRoot(chain: Delegation[]): string;
/** Emit an in-toto Decision Receipt v0.1 envelope.
 *
 *  Pure function. Given an intent/decision/receipt triple and the delegation
 *  chain that authorized it, produces a DSSE-style signed Statement whose
 *  predicate carries delegation_chain_root, delegation_depth, and the typed
 *  epistemic_claims. The caller retains the ordinary PolicyReceipt for v2.2.x
 *  consumers and emits this envelope in parallel for v2.3-aware verifiers.
 *
 *  The returned envelope's payload string is the JCS canonicalization of the
 *  in-toto Statement — signed bytes match the payload field exactly, so a
 *  verifier canonicalizes json.loads(envelope.payload) and checks equality
 *  before verifying the signature. Cross-repo interop requires nothing more
 *  than JCS and Ed25519. */
export declare function emitDecisionReceipt(input: EmitDecisionReceiptInput): DecisionReceiptEnvelope;
/** Parse a DecisionReceiptEnvelope payload back into its in-toto Statement.
 *  Round-trip: canonicalizeJCS(parseDecisionReceiptStatement(env)) === env.payload. */
export declare function parseDecisionReceiptStatement(envelope: DecisionReceiptEnvelope): IntotoStatement;
//# sourceMappingURL=decisionReceipt.d.ts.map