import type { Signer } from '../../adapters/remote-signer/types.js';
import type { RevocationFreshnessResult } from '../../types/policy.js';
import type { RevocationObservation, RevocationObservationDecision, RevocationOutcomeLabel, RevocationStatusSource, SignedRevocationObservation, ObservationVerifyResult, SecurityEventTokenClaims, RefreshOutcome } from './types.js';
/** Input to buildRevocationObservation. Field semantics are those of
 *  {@link RevocationObservation}; timestamps accept Date for convenience and
 *  are stored ISO 8601. */
export interface BuildObservationParams {
    authority_ref: string;
    status_source: RevocationStatusSource;
    revoked_at?: Date | string;
    /** Defaults to now. */
    observed_at?: Date | string;
    maximum_staleness_ms: number;
    affected_scope?: string;
    /** The decision reached under the relying party's freshness policy. A full
     *  FreshnessDecision may be passed; only effect and downgraded are stored
     *  (the frozen field shape), the rest stays verifier-local. */
    decision: RevocationObservationDecision & {
        [extra: string]: unknown;
    };
    workflow_response?: RefreshOutcome;
}
/**
 * Build and sign a RevocationObservation.
 *
 * Signing follows the module's Signer discipline: like buildRevocationSET,
 * this builder does not introduce its own key handling; the caller supplies
 * the SDK {@link Signer} (local or remote custody) and the signature is that
 * signer's Ed25519 signature over the canonical form of the record with the
 * `signature` field absent. observer_key and observer_key_id are taken from
 * the signer and are covered by the signature, so the record binds its own
 * verification key material.
 *
 * The record asserts an observation under a stated freshness contract. It
 * does not assert instant or universal revocation.
 */
export declare function buildRevocationObservation(params: BuildObservationParams, signer: Signer): Promise<SignedRevocationObservation>;
/**
 * Verify a signed observation: structural well-formedness, then the Ed25519
 * signature over the canonical record with `signature` absent, against the
 * record's own observer_key (or a caller-pinned expected key).
 *
 * Verifying proves the named observer signed this observation. It does not
 * prove the observed revocation is true or current beyond the freshness
 * contract the record states, and it does not prove any other relying party
 * observed the same signal.
 */
export declare function verifyRevocationObservation(record: SignedRevocationObservation, opts?: {
    expectedObserverKey?: string;
}): ObservationVerifyResult;
/**
 * Derive the outcome label for an observation. The label is verifier-report
 * vocabulary: it is computed on demand and never stored in the signed record.
 *
 * Derivation:
 *  - a revocation was observed (revoked_at present):
 *      - workflow_response refused a refresh because the original was revoked
 *        (reissued false, reason 'revoked'): 'running_terminated', the in
 *        flight workflow was cut short by the observed revocation;
 *      - decision deny: 'revoked_blocked'.
 *  - no revocation signal (revoked_at absent): the record's frozen decision
 *    slot carries effect and downgraded only, which cannot distinguish a
 *    fresh source from a stale or unreachable one. The caller supplies the
 *    freshness result it recorded (RevocationFreshnessRecord.result) as
 *    classification CONTEXT; it is consumed here and never stored:
 *      - 'fresh': 'fresh_valid';
 *      - 'stale': 'stale_denied' or 'stale_permitted' by decision effect;
 *      - 'unavailable' or 'skipped' (no signal obtained either way):
 *        'unavailable_fail_closed' or 'unavailable_fail_open' by effect.
 *
 * Throws on combinations outside the seven labels (an observed revocation
 * that was allowed without a terminating workflow response, a fresh deny, or
 * a missing freshness context when no revocation was observed): those states
 * are not representable outcomes of decideFreshness and indicate a
 * malformed observation rather than an eighth category.
 */
export declare function classifyObservation(observation: RevocationObservation, freshness?: {
    result: RevocationFreshnessResult;
}): RevocationOutcomeLabel;
/**
 * Map a received Security Event Token claim set into builder params for a
 * RevocationObservation.
 *
 * Wiring per the freeze: status_source becomes {kind: 'set', jti} carrying
 * the SET's replay key, and the CAEP event_timestamp (seconds since the Unix
 * epoch) is converted to ISO 8601 for revoked_at, keeping the SDK-wide
 * timestamp convention; milliseconds and epoch seconds are never mixed in
 * one field.
 *
 * Audience note: a SET's `aud` is the RFC 8417 JWT audience claim, a
 * receiver hint on the event token. It is not the APS AudienceBinding shape
 * (the in-body receipt binding checked by checkAudience), and this helper
 * does not read it: whether the SET was addressed to this receiver is the
 * transport layer's check, made before ingestion.
 *
 * Callers SHOULD validate the claim set with isWellFormedSET first; this
 * helper re-asserts only the fields it dereferences. Receiving a SET is an
 * observation of one emitter's signal under this receiver's freshness
 * contract; it is not proof of instant or universal revocation.
 */
export declare function observationParamsFromSET(set: SecurityEventTokenClaims, params: {
    decision: BuildObservationParams['decision'];
    maximum_staleness_ms: number;
    observed_at?: Date | string;
    affected_scope?: string;
    workflow_response?: RefreshOutcome;
}): BuildObservationParams;
//# sourceMappingURL=observation.d.ts.map