import type { KeyResolver } from '../key-resolution/types.js';
import type { TrustRootPolicy, TrustPolicyVerdict } from './types.js';
/** The mechanical signer facts the verifier reads off a receipt. These
 *  are facts about WHICH key signed WHICH claim, never an assurance the
 *  issuer set. */
export interface ReceiptSignerFacts {
    /** The issuer/signer identity to match against trusted_issuers. For a
     *  Cycles receipt this is the receipt.signer (raw hex) or the DID URI
     *  before the '#'. */
    issuer_id: string;
    /** 64-char lowercase hex Ed25519 public key that actually signed the
     *  receipt. For a DID-URI signer the verifier resolves this; for a raw
     *  hex signer it IS the signer string. */
    signer_pubkey_hex: string;
}
export interface EvaluateOptions {
    /** Current time (unix ms). Used for key-window and rotation checks. */
    now_ms: number;
    /** When true, evaluate fully offline: pinned-byte matching only, no
     *  resolver call. Honors the policy's offline_behavior. */
    offline?: boolean;
    /** Online key resolver (M3). Required for the online live-confirm path
     *  when a pinned key carries a locator; ignored when offline. */
    resolver?: KeyResolver;
}
/** Evaluate a receipt's signer facts against a SIGNED, already-verified
 *  trust-root-policy and return a verifier-derived verdict.
 *
 *  Precondition: the caller verified the policy artifact itself with
 *  verifyTrustRootPolicy (signature + freshness + anti-rollback) before
 *  calling this. This function decides acceptance of a SIGNER under a
 *  KNOWN-GOOD policy version; it does not re-verify the policy. */
export declare function evaluateReceiptAgainstPolicy(receipt: ReceiptSignerFacts, policy: TrustRootPolicy, options: EvaluateOptions): Promise<TrustPolicyVerdict>;
//# sourceMappingURL=verdict.d.ts.map