import type { AttestationFreshness } from '../../types/passport.js';
import type { ActionReceipt } from '../../types/passport.js';
import type { RevocationFreshnessRecord } from '../../types/policy.js';
import type { ScopeOfClaim } from '../accountability/types/base.js';
/** Default uniform clock skew (5 minutes), matching instruction-provenance. */
export declare const DEFAULT_CLOCK_SKEW_MS: number;
export type SkewVerdict = 'valid' | 'not_yet_valid' | 'expired';
export interface SkewCheckResult {
    verdict: SkewVerdict;
    /** Milliseconds the timestamp is outside the tolerated window (0 when valid). */
    outsideByMs: number;
}
/**
 * Check a single timestamp window against a uniform clock skew.
 *
 * A timestamp `iat` is `not_yet_valid` only when it exceeds `now + skew`.
 * An `exp` is `expired` only when it precedes `now - skew`. Exactly at the
 * boundary (`iat === now + skew` or `exp === now - skew`) the verdict is
 * `valid`: the boundary is inclusive. This matches the ap2 and
 * instruction-provenance comparisons (`>` / `<`, not `>=` / `<=`).
 */
export declare function checkClockSkew(opts: {
    /** Issued-at (not-before) instant. */
    iat?: Date | string | number;
    /** Expiry instant. */
    exp?: Date | string | number;
    /** Verifier clock; defaults to now. */
    now?: Date;
    /** Allowed skew in milliseconds; defaults to {@link DEFAULT_CLOCK_SKEW_MS}. */
    allowedClockSkewMs?: number;
}): SkewCheckResult;
/** Minimal hook a verifier calls to enforce single-use of an identifier. */
export interface SeenSet {
    /** Record `id` as seen. Returns true if this is the FIRST time `id` is
     *  recorded (accept), false if `id` was already present (replay, reject). */
    recordIfFirst(id: string): boolean;
    /** Whether `id` has already been recorded, without recording it. */
    has(id: string): boolean;
}
/** Reference in-memory seen-set. Single process lifetime only. NOT durable. */
export declare class InMemorySeenSet implements SeenSet {
    private readonly seen;
    recordIfFirst(id: string): boolean;
    has(id: string): boolean;
    /** Number of distinct ids recorded. For tests and metering by the caller. */
    get size(): number;
}
export type ReplayVerdict = 'accepted' | 'rejected_replay' | 'rejected_missing_id';
export interface ReplayCheckResult {
    verdict: ReplayVerdict;
    /** The id that was checked, when one was present. */
    id?: string;
}
/**
 * Enforce single-use of a receipt's `jti` / `evidence_id` against a seen-set.
 *
 * Returns `accepted` on the first submission of an id, `rejected_replay` on a
 * repeat, and `rejected_missing_id` when no id is present (a verifier that
 * MUST enforce replay cannot do so for an id-less receipt; surfacing this is
 * the safe default rather than silently accepting).
 */
export declare function checkReplay(id: string | undefined, seen: SeenSet): ReplayCheckResult;
/**
 * Build a {@link RevocationFreshnessRecord} for the policy receipt.
 *
 * Reuses {@link AttestationFreshness} for the staleness shape. The `result`
 * is derived as follows:
 *   - 'skipped'     when the verifier did not consult a source.
 *   - 'unavailable' when the source could not be reached.
 *   - 'fresh'       when the source was reached and isEvidenceFresh() holds
 *                   AND the measured age is within maxStalenessMs.
 *   - 'stale'       when the source was reached but is older than tolerated.
 *
 * `allowedDespiteStale` records whether the verifier proceeded anyway. It is
 * an explicit, auditable risk acceptance, never inferred.
 */
export declare function recordRevocationFreshness(opts: {
    source: string;
    maxStalenessMs: number;
    checkedAt?: Date;
    /** Omit when the verifier chose not to check (→ 'skipped'). */
    freshness?: AttestationFreshness;
    /** True when the source could not be reached (→ 'unavailable'). */
    unavailable?: boolean;
    /** When true, the verifier proceeded even on a non-fresh result. */
    allowDespiteStale?: boolean;
}): RevocationFreshnessRecord;
/** Hash of a receipt for use as the previous-hash link in the next receipt.
 *  Excludes the `signature` so a receipt's link is stable before signing,
 *  and is independent of the action_ref preimage. */
export declare function hashReceiptForChain(receipt: ActionReceipt): string;
export type SequenceGapKind = 'counter_gap' | 'hash_break' | 'out_of_order';
export interface SequenceGap {
    kind: SequenceGapKind;
    /** 0-based index in the supplied stream where the gap was detected. */
    atIndex: number;
    detail: string;
}
export interface SequenceCheckResult {
    /** True only when no gaps were detected across the whole stream. */
    continuous: boolean;
    gaps: SequenceGap[];
}
/**
 * Verify continuity across an ordered receipt stream from a single issuer.
 *
 * Two independent signals make a deleted receipt detectable:
 *   - monotonic counter: consecutive `sequenceNumber`s must increase by 1.
 *     A jump (n, n+2) flags a `counter_gap`; a non-increase flags
 *     `out_of_order`.
 *   - hash link: each receipt's `previousReceiptHash` must equal the chain
 *     hash of its predecessor. A mismatch flags a `hash_break`.
 *
 * A receipt missing both signals is skipped for that signal (the check is
 * additive and back-compatible). The result is `continuous` only when every
 * present signal is intact. Detecting a gap does NOT prove which receipt was
 * removed, only that one is missing between two presented receipts.
 */
export declare function verifyReceiptSequence(receipts: ActionReceipt[]): SequenceCheckResult;
/** The proof box rendered as a ScopeOfClaim, for callers that emit an
 *  accountability receipt covering a hardening check. Mirrors the PROOF BOX. */
export declare function buildHardeningScopeOfClaim(): ScopeOfClaim;
//# sourceMappingURL=index.d.ts.map