import { type TrustRootPolicy, type TrustRootPolicyBody, type TrustedIssuer, type ResolverRule, type RotationRule, type StaleBehavior, type OfflineBehavior, type PolicyVerifyOutcome } from './types.js';
export interface BuildTrustRootPolicyInput {
    policy_id: string;
    policy_version: number;
    issued_at: number;
    refresh_after: number;
    trusted_issuers: TrustedIssuer[];
    resolver_rules?: ResolverRule[];
    rotation?: RotationRule;
    default_stale_behavior?: StaleBehavior;
    offline_behavior?: OfflineBehavior;
}
/** Build an unsigned trust-root-policy body. Defaults preserve the
 *  fail-closed / pins-only posture. Call signTrustRootPolicy next. */
export declare function buildTrustRootPolicy(input: BuildTrustRootPolicyInput, publisher_pubkey_hex: string): TrustRootPolicyBody;
export declare function signTrustRootPolicy(unsigned: TrustRootPolicyBody, publisher_sk_hex: string): TrustRootPolicy;
export interface VerifyTrustRootPolicyOptions {
    /** The verifier's root-trusted publisher key set. The policy MUST be
     *  signed by one of these, not merely self-signed. */
    trusted_publisher_pubkeys_hex: string[];
    /** Current time (unix ms). */
    now_ms: number;
    /** Anti-rollback floor. When supplied, a policy whose policy_version is
     *  strictly below this is rejected as version_rolled_back. A verifier
     *  persists the highest accepted version per policy_id and feeds it
     *  back here; this is what prevents an attacker re-serving an older,
     *  weaker signed policy. */
    min_policy_version?: number;
}
/** Verify a trust-root-policy: publisher membership, signature,
 *  freshness window, then the anti-rollback version gate. Same order and
 *  posture as verifyBundle, with the added version check. */
export declare function verifyTrustRootPolicy(policy: TrustRootPolicy, options: VerifyTrustRootPolicyOptions): PolicyVerifyOutcome;
//# sourceMappingURL=policy.d.ts.map