import type { ActionTimeContextRootInput, VerificationResult, VerifyIPRInput } from './types.js';
/**
 * Verify an InstructionProvenanceReceipt envelope per spec §6.
 *
 * Pipeline:
 *   §6.1 schema + signature
 *   §6.2 delegation linkage (signature key matches signing_key_id)
 *   §6.3 path canonicalization, sort order, context_root, exhaustiveness
 *   §6.4 issued_at + expires_at + bound_to consistency
 *
 * Filesystem-side checks (§6.3 step 10/11 cross-walk vs disk) only run
 * when `filesystemCheck: true` AND `working_root` exists on this host.
 */
export declare function verifyInstructionProvenanceReceipt(input: VerifyIPRInput): VerificationResult;
/**
 * §6.5 — when an IPR carries `recompute_at_action: true`, every action
 * receipt under its binding scope MUST include `context_root_at_action_time`
 * computed by re-walking discovery_patterns. This helper compares.
 */
export declare function verifyActionTimeContextRoot(input: ActionTimeContextRootInput): VerificationResult;
/**
 * Tiny POSIX-glob matcher. Supports `*`, `?`, `**`, character literals.
 * Patterns are matched against canonical relative paths (no leading `/`,
 * forward-slash separators). Patterns may start with `./` (stripped) or
 * `**` for recursive match.
 */
export declare function matchesAnyPattern(path: string, patterns: readonly string[]): boolean;
//# sourceMappingURL=verify.d.ts.map