import type { ActionIntent, PolicyDecision } from '../types/policy.js';
import type { ContentHash, EvaluationMethod, ScopeInterpretation, DecisionSemantics, DecisionArtifact, DecisionArtifactVerification } from '../types/decision-semantics.js';
/**
 * Minimum required identity boundary fields per artifact type.
 * The spec declares these minimums — artifacts can commit to more but not fewer.
 */
export declare const MINIMUM_IDENTITY_FIELDS: Record<string, string[]>;
export declare function computeContentHash(intent: Omit<ActionIntent, 'signature' | 'contentHash'>): Promise<ContentHash>;
/** Write-boundary twin of computeContentHash().
 *
 *  Shares one implementation body with computeContentHash() so the two can never drift apart
 *  on the field list. Emits the same bytes for every value it accepts; the only
 *  difference is that an integer-valued number outside the interoperable IEEE 754
 *  range is refused instead of serialized. Use at signing and new-write boundaries
 *  ONLY: computeContentHash() stays unrestricted so an artifact signed before this rule keeps
 *  verifying. */
export declare function computeContentHashForWrite(intent: Omit<ActionIntent, 'signature' | 'contentHash'>): Promise<ContentHash>;
/**
 * Verify that a content hash matches the intent it claims to represent.
 * If identityBoundary is present, verifies the boundary was committed into the hash.
 */
export declare function verifyContentHash(intent: ActionIntent): Promise<{
    valid: boolean;
    error?: string;
}>;
/**
 * Validate that an identity boundary meets the spec minimum for its artifact type.
 * The spec declares minimum required fields — the artifact can commit to more but not fewer.
 */
export declare function validateIdentityBoundary(boundary: string[], artifactType: string): {
    valid: boolean;
    missing: string[];
};
/**
 * Create an ActionIntent with a content hash embedded.
 * The hash is computed over the unsigned, unhashed intent,
 * then included in the object before signing.
 * This means the signature covers the hash — binding content identity to signer identity.
 */
export declare function createContentAddressableIntent(opts: {
    agentId: string;
    agentPublicKey: string;
    delegationId: string;
    action: ActionIntent['action'];
    context?: string;
    privateKey: string;
}): Promise<ActionIntent>;
/**
 * Classify the evaluation method of a PolicyDecision.
 * If the decision already has evaluationMethod set, returns it.
 * Otherwise infers from the principles evaluated.
 */
export declare function classifyEvaluationMethod(decision: PolicyDecision): EvaluationMethod;
/**
 * Decompose a PolicyDecision into structural vs trust components.
 * Structural: F-001 through F-005 (scope, delegation, registration)
 * Trust: F-006, F-007, and any reputation/behavioral checks
 */
export declare function decomposeDecision(decision: PolicyDecision): DecisionSemantics;
/**
 * Create a cross-engine decision artifact from an intent + decision pair.
 * Bundles the pre-execution decision with its semantic decomposition
 * into a single verifiable, content-addressable object.
 */
export declare function createDecisionArtifact(opts: {
    intent: ActionIntent;
    decision: PolicyDecision;
    engine: string;
    version?: string;
    signerPrivateKey: string;
}): Promise<DecisionArtifact>;
/**
 * Verify a decision artifact against the trust anchors the caller supplies.
 *
 * SCOPE OF CLAIM.
 *   Establishes, when `valid` is true: the artifact envelope was signed by
 *     `keys.artifactSignerPublicKey`; `originalIntent` was signed by
 *     `keys.intentSignerPublicKey` and `originalDecision` by
 *     `keys.decisionSignerPublicKey`; the decision decides that intent; and
 *     every value the artifact projects from either source equals its source.
 *   Does NOT establish: that those three keys are the right ones — that is
 *     the relying party's allowlist, not this function's; that the evaluator
 *     was entitled to decide this action; that the decision's reasoning is
 *     sound; or that any of the three parties are distinct (see the
 *     same-key note below).
 *
 * The trust anchors are the whole point. An artifact-carried key —
 * `intent.agentPublicKey`, `decision.evaluatorPublicKey` — is a claim the
 * artifact makes about itself, so verifying against it establishes only that
 * whoever wrote the artifact also held one key. Both are now verified against
 * the caller's anchors, and each embedded key must additionally agree with
 * the anchor it was verified under: the signature covers the embedded key, so
 * a mismatch is an artifact whose signed content contradicts its own signer.
 *
 * The projection checks matter as much as the signatures. The artifact copies
 * the verdict, the evaluator, the decision id, the principle list and the two
 * inner signature strings out of objects it does not carry. Signing those
 * copies proves the artifact's author committed to them, not that they are
 * what the evaluator decided; only comparison against the source does that.
 *
 * SAME-KEY ROLES. Nothing here requires the three anchors to be distinct. A
 * caller that passes one key for all three gets a chain in which one party
 * requested, decided and attested. That is a policy question the repo has no
 * field to express (`Office.incompatibleOffices` in src/types/charter.ts is
 * the only role-separation concept, and it does not reach this layer), so it
 * is left to the caller rather than invented here.
 */
export declare function verifyDecisionArtifact(artifact: DecisionArtifact, keys: {
    /** Trust anchor for the intent: the agent this relying party accepts. */
    intentSignerPublicKey: string;
    /** Trust anchor for the decision: the evaluator this relying party accepts. */
    decisionSignerPublicKey: string;
    /** Trust anchor for the artifact envelope. */
    artifactSignerPublicKey: string;
}, originalIntent: ActionIntent, originalDecision: PolicyDecision): Promise<DecisionArtifactVerification>;
/**
 * Get the effective scope interpretation for a delegation.
 * Defaults to 'hierarchical' — APS's native scope matching.
 */
export declare function getEffectiveScopeInterpretation(delegation: {
    scopeInterpretation?: ScopeInterpretation;
}): ScopeInterpretation;
export declare function sha256Hex(data: string): Promise<string>;
//# sourceMappingURL=decision-semantics.d.ts.map