import type { SignedPassport, KeyPair, FloorAttestation, ActionReceipt, Delegation, ValuesFloor, BeneficiaryInfo, MerkleProof, AttributionReport, ComplianceReport, BeneficiaryTrace } from './types/passport.js';
export interface JoinOptions {
    name: string;
    mission: string;
    owner: string;
    capabilities: string[];
    platform: string;
    models: string[];
    floor?: ValuesFloor | string;
    floorExtensions?: string[];
    validityWindow?: {
        notBefore?: string;
        notAfter: string;
    };
    beneficiary?: {
        id: string;
        relationship: 'creator' | 'employer' | 'delegator' | 'owner';
    };
}
export interface SocialContractAgent {
    passport: SignedPassport;
    keyPair: KeyPair;
    attestation: FloorAttestation | null;
    agentId: string;
    publicKey: string;
}
/**
 * Join the Agent Social Contract.
 *
 * One call. Creates identity, attests to values, registers beneficiary.
 * Returns everything an agent needs to participate.
 */
export declare function joinSocialContract(opts: JoinOptions): SocialContractAgent;
export interface TrustVerification {
    identity: {
        valid: boolean;
        errors: string[];
        warnings: string[];
    };
    values: {
        attested: boolean;
        valid: boolean;
        errors: string[];
    } | null;
    /** Whether a trust root was consulted at all, i.e. whether the caller
     *  supplied a usable non-empty trustedIssuers list — or supplied a
     *  malformed one, which is a demand for a trust check that could not be
     *  honoured and is therefore never reported as "not asked". */
    issuerChecked: boolean;
    /** Whether an issuer countersignature from one of those trusted issuers
     *  verified. Always false when no trust root was consulted, and always
     *  false when the trustedIssuers value was malformed. */
    issuerTrusted: boolean;
    /** Why the issuer check failed, when one ran — including the case where
     *  the trustedIssuers value itself was rejected, which is reported here
     *  and names the option. Kept out of identity.errors so that a missing or
     *  misconfigured trust root never reads as a defect in the passport
     *  itself. An empty array with issuerChecked false is the only "no trust
     *  root configured" state; a malformed value is distinguishable from it. */
    issuerErrors: string[];
    /** The passport's own signature, its validity window, and the values
     *  attestation when one was supplied. A property of the BYTES: it does
     *  not move when the caller changes their trust configuration. It is not
     *  an authorization by a trust root; `issuerTrusted` is that. */
    structurallyValid: boolean;
    /** @deprecated Reading this emits a runtime DeprecationWarning.
     *
     *  Equal to `structurallyValid && (!issuerChecked || issuerTrusted)`,
     *  which is exactly what this field always returned. The name says
     *  "overall" and was rendered to operators as TRUSTED, but with no
     *  trustedIssuers supplied it has only ever meant "the bytes check out".
     *  Read `structurallyValid` and `issuerTrusted` instead and decide
     *  explicitly which one your call site needs. */
    overall: boolean;
}
export interface VerifySocialContractOptions {
    /** Issuer public keys the caller trusts. When supplied and non-empty, the
     *  passport must carry a valid countersignature from one of them for
     *  `issuerTrusted` to be true. When omitted, no external trust root is
     *  consulted, `issuerChecked` is false, and `issuerTrusted` is false.
     *
     *  Normalized through `normalizeTrustAnchors`, the same boundary the other
     *  two readers of this option use. Anything that is not an array of
     *  non-empty strings is a configuration error: it is refused and named in
     *  `issuerErrors`, never coerced into "no anchors" and never read as one. */
    trustedIssuers?: string[];
}
/**
 * Verify another agent's standing in the social contract.
 *
 * Two independent questions, answered by two separate checks so that
 * neither can move the other:
 *
 *   structurallyValid — the passport signature, its validity window, and
 *     the values attestation if one was supplied, all check out. Computed
 *     WITHOUT the caller's anchors, so it is a statement about the bytes and
 *     is stable across trust configurations. Round 1 computed it from the
 *     anchored check, so a byte-identical passport flipped true to false
 *     purely because the caller passed a trustedIssuers list, and the CLI
 *     printed a failure over a passport that verified.
 *   issuerTrusted     — an issuer the CALLER named countersigned this
 *     passport. This is the statement about standing.
 *
 * Without `trustedIssuers`, only the first question is answered.
 * `issuerChecked` reports whether the second one was even asked, so "no
 * trust root consulted" is never indistinguishable from "trust root
 * consulted and failed".
 */
export declare function verifySocialContract(passport: SignedPassport, attestation?: FloorAttestation | null, opts?: VerifySocialContractOptions): TrustVerification;
export interface DelegateOptions {
    from: SocialContractAgent;
    toPublicKey: string;
    scope: string[];
    spendLimit?: number;
    maxDepth?: number;
    expiresInHours?: number;
}
/**
 * Delegate authority from one agent (or human) to another.
 */
export declare function delegate(opts: DelegateOptions): Delegation;
export interface WorkOptions {
    type: string;
    target: string;
    scope: string;
    spend?: number;
    currency?: string;
    result: 'success' | 'failure' | 'partial';
    summary: string;
}
/**
 * Record a unit of work under a delegation.
 *
 * Returns a signed, verifiable receipt.
 */
export declare function recordWork(agent: SocialContractAgent, delegation: Delegation, delegationChain: string[], work: WorkOptions): ActionReceipt;
export interface ContributionProof {
    attribution: AttributionReport;
    merkleRoot: string;
    proofs: Map<string, MerkleProof>;
    traces: BeneficiaryTrace[];
}
/**
 * Generate cryptographic proof of an agent's contributions.
 *
 * Moved to @aeoess/gateway (attribution-reports) because proof generation
 * depends on scope-weight product policy. See MIGRATION.md#attribution-reports.
 */
export declare function proveContributions(_agent: SocialContractAgent, _receipts: ActionReceipt[], _delegations: Delegation[], _beneficiary: string, _beneficiaryMap?: Map<string, BeneficiaryInfo>): ContributionProof;
/**
 * Audit an agent's compliance. Requires a verifier keypair
 * (the auditor signs the report).
 */
export declare function auditCompliance(agentId: string, receipts: ActionReceipt[], floor: ValuesFloor, delegations: Map<string, {
    scope: string[];
    revoked: boolean;
}>, verifierKeyPair: KeyPair): ComplianceReport;
//# sourceMappingURL=contract.d.ts.map