import { type AttestorRoleAnswer, type AttestorRoleResolver, type AuthorityBound, type AuthorityBoundFulfilment, type BoundEvaluation, type BoundKind, type BoundVerificationKeyResolver, type FulfilmentAssessment } from './types.js';
/** Thrown when an input this module cannot read at all is passed. A malformed BOUND is a
 *  programming error, not a verdict: the module was asked a question about nothing. A
 *  malformed FULFILMENT RECORD is different and never throws, because a record somebody
 *  else wrote is data, and the right answer about it is a rejection with a reason code. */
export declare class AuthorityBoundError extends Error {
    readonly code: string;
    constructor(code: string, message: string);
}
export declare function isBoundKind(value: unknown): value is BoundKind;
export declare function isAttestorRoleAnswer(value: unknown): value is AttestorRoleAnswer;
/** Shape check for a bound declaration. Throws, for the reason `AuthorityBoundError`
 *  documents. */
export declare function assertAuthorityBound(bound: AuthorityBound): void;
export interface AssessFulfilmentInput {
    readonly bound: AuthorityBound;
    readonly record: AuthorityBoundFulfilment;
    /** The instant the question is asked at. A record attested later than this is not read:
     *  a verifier asked about Tuesday does not get to use Wednesday's evidence. */
    readonly atInstant: string;
    readonly resolveAttestorRole: AttestorRoleResolver;
    readonly resolveVerificationKey: BoundVerificationKeyResolver;
}
/**
 * Assess ONE fulfilment record against one bound.
 *
 * The order of the checks is the substance of this function, not an implementation detail.
 * Standing is asked FIRST and authenticity SECOND, and each produces its own code, because
 * "authenticated by somebody who may not say this" and "not authenticated at all" are
 * different failures and collapsing them loses the distinction CAND-01 turns on. A valid
 * signature establishes who signed. It does not establish that the signer was allowed to
 * make this statement.
 *
 * `FULFILMENT_OUTCOME_NOT_FULFILLED` carries no `missing` limbs, and that is deliberate: a
 * record from a party with standing saying the purpose was NOT met is a conclusion the
 * verifier reached, not a gap in its evidence. Every other rejection names a limb.
 *
 * Concept source: aeoess/agent-authority-lifecycle, invariant candidate CAND-01 and
 * invariant candidate BROAD-L7. Proposed.
 */
export declare function assessFulfilment(input: AssessFulfilmentInput): FulfilmentAssessment;
export interface EvaluateBoundInput {
    readonly bound: AuthorityBound;
    /** Every fulfilment claim the caller holds for this bound. Order is preserved in the
     *  result and does not change the verdict: see the resolution rule below. Empty for a
     *  `use_count` or `budget` bound, where no attestation is involved. */
    readonly fulfilments?: readonly AuthorityBoundFulfilment[];
    readonly atInstant: string;
    readonly resolveAttestorRole?: AttestorRoleResolver;
    readonly resolveVerificationKey?: BoundVerificationKeyResolver;
    /** kind `use_count` only: admissions already counted against this bound, as a canonical
     *  unsigned decimal integer string. The caller's ledger owns this number. This module
     *  does not count admissions, because counting them means holding state across events and
     *  a pure function has none. */
    readonly consumed?: string;
    /** kind `budget` only: the committed and reserved totals, exactly as
     *  `InMemoryAuthorityBudgetLedger.counter(delegationId)` returns them. The budget kind
     *  delegates to that ledger and never reimplements it: draft-03 section 3.4 already
     *  states the rule, and the ledger already enforces it. */
    readonly budgetCounter?: {
        readonly committed: string;
        readonly reserved: string;
    };
}
/**
 * Evaluate one bound's state at one instant.
 *
 * THE RESOLUTION RULE, and why it is this way round. For a purpose bound:
 *
 *   1. If any fulfilment record was ACCEPTED, the state is `exhausted`.
 *   2. Otherwise, if any record was rejected on an EVIDENTIAL ground (signature, standing,
 *      unresolved role, unresolved key, unreadable shape), the state is `not_established`.
 *   3. Otherwise the state is `not_reached`.
 *
 * Step 1 comes before step 2 on purpose, and it is invariant CAND-02's rule made
 * executable: an exhaustion that WAS established is never downgraded by a later claim
 * nobody could authenticate. A later finding is a new record about an earlier one, never a
 * rewrite of it. Because the rule is a fold over the whole set rather than a running
 * mutation, the verdict is the same whatever order the records arrive in, which is what
 * makes it safe for a caller to keep them in an unordered store.
 *
 * Step 3 reads `not_reached` from an empty record set, and that is the one reading here
 * worth arguing with. It is a positive claim: the bound is declared, no evidence reaches
 * it, and under the applicable authority model a purpose that nobody has recorded as met is
 * a purpose that is not met. A model whose default runs the other way (absence of a
 * periodic fulfilment report is itself the trigger) is a model this function cannot
 * express, and a caller in that position should report `not_established` with a `source`
 * limb rather than passing an empty set and reading the answer as a finding. CAND-01's
 * carve-out for a declared default on absence is the reason the disclaimer is here and not
 * a silent assumption.
 *
 * A `use_count` bound needs no records at all: the ADMISSION reaches it, so `consumed`
 * against `value` is the whole computation. A `budget` bound is answered by the ledger's
 * counter, per draft-03 section 3.4, verbatim: "Signatures establish static limits; they do
 * not establish the current cumulative total."
 *
 * Reported ALONGSIDE a chain result, never merged into it, and never in place of it. A
 * grant can be exhausted while its chain still verifies `valid`, which is the whole point:
 * exhaustion is invisible to chain verification. A grant can also be expired AND exhausted,
 * and then the chain result says `EXPIRED` and this says `exhaustion` and neither
 * overwrites the other. Invariant L10.
 *
 * Concept source: aeoess/agent-authority-lifecycle, invariant L10 and invariant candidates
 * CAND-01 and CAND-02. All proposed.
 */
export declare function evaluateBound(input: EvaluateBoundInput): BoundEvaluation;
//# sourceMappingURL=evaluate.d.ts.map