export type GovernanceChangeType = 'strengthening' | 'neutral' | 'weakening' | 'mixed' | 'initial';
export interface GovernanceDiff {
    changeType: GovernanceChangeType;
    additions: string[];
    modifications: string[];
    removals: string[];
    isWeakening: boolean;
    isStrengthening: boolean;
}
export interface GovernanceArtifact {
    artifactId: string;
    artifactType: 'floor' | 'policy' | 'config' | 'delegation-template' | 'custom';
    version: string;
    previousVersion: string | null;
    previousArtifactId: string | null;
    contentHash: string;
    content: string;
    issuer: string;
    effectiveFrom: string;
    expiresAt: string | null;
    breaking: boolean;
    supersedes: string | null;
    rollbackAllowed: boolean;
    changeType: GovernanceChangeType;
    additions: string[];
    modifications: string[];
    removals: string[];
    credentialLifecycle?: CredentialLifecyclePolicy;
    metadata: Record<string, unknown>;
    createdAt: string;
    signature: string;
}
export interface GovernanceEnvelope {
    artifact: GovernanceArtifact;
    approvals: GovernanceApproval[];
}
export interface GovernanceApproval {
    approver: string;
    approvedAt: string;
    artifactId: string;
    contentHash: string;
    signature: string;
}
export interface GovernanceVerification {
    valid: boolean;
    errors: string[];
    /** Non-fatal notes about how the policy was interpreted. Carries the
     *  ignored-wildcard note, so a narrowed allowlist is legible rather than
     *  silently applied. */
    warnings: string[];
    contentIntegrity: boolean;
    signatureValid: boolean;
    chainValid: boolean;
    notExpired: boolean;
    approvalsValid: boolean;
    weakeningApproved: boolean;
}
/** Wildcard entry for GovernanceLoadPolicy.allowedIssuers: accept an
 *  artifact from any issuer.
 *
 *  It is honoured ONLY when it is the SOLE entry of the list. This is not a
 *  style preference, it is the safety property: `['*']` is spread and
 *  appended to, and a wildcard that survived concatenation would turn the
 *  idiom an operator uses to HARDEN a policy
 *
 *      { ...DEFAULT_LOAD_POLICY,
 *        allowedIssuers: [...DEFAULT_LOAD_POLICY.allowedIssuers, myKey] }
 *
 *  into one that disables the check. Naming any issuer alongside the
 *  wildcard means the operator named issuers, so the list is read as a
 *  closed allowlist of the named ones and the wildcard is dropped with a
 *  warning on the result. */
export declare const ANY_ISSUER = "*";
export interface GovernanceLoadPolicy {
    requireSignature: boolean;
    requireApprovals: number;
    /** Issuer public keys this policy accepts.
     *
     *    []                  accepts none, rejects every artifact
     *    ['*']               accepts any issuer (ANY_ISSUER, sole entry only)
     *    [k1, k2]            closed allowlist
     *    ['*', k1]           closed allowlist of [k1]; the wildcard is
     *                        dropped and reported in `warnings`
     *
     *  An empty list used to skip the check entirely, which made "no anchors"
     *  and "all anchors" the same input. */
    allowedIssuers: string[];
    allowExpired: boolean;
    allowBreakingWithoutApproval: boolean;
    requireApprovalsForWeakening: number;
    requireApprovalsForRemoval: number;
    blockWeakeningWithoutApproval: boolean;
}
export declare const DEFAULT_LOAD_POLICY: GovernanceLoadPolicy;
export interface CredentialLifecyclePolicy {
    /** Maximum session duration in seconds before re-authentication required */
    maxSessionDurationSeconds: number;
    /** Optional URL for real-time revocation checks */
    revocationEndpoint?: string;
    /** Credential time-to-live in seconds from issuance */
    credentialTTLSeconds: number;
    /** How often (seconds) to poll revocation endpoint */
    revocationCheckFrequencySeconds: number;
}
//# sourceMappingURL=governance.d.ts.map