import type { SignedPassport } from '../types/passport.js';
import type { CoreVerifyClockOptions } from '../types/policy.js';
/** Why a passport failed the posture check. */
export type TrustPostureFailure = 
/** Signature, validity window, or a demanded issuer countersignature failed. */
'PASSPORT_INVALID'
/** The passport is sound, but the gate holds no trust anchor for it and the
 *  caller did not say self-signed credentials are acceptable. */
 | 'UNTRUSTED_ISSUER';
export interface TrustPostureOptions {
    /** Trust anchors: issuer public keys whose countersignature this gate
     *  accepts. A NON-EMPTY list requires a valid countersignature from one of
     *  them, and `allowSelfSigned` does not override that. An empty list, or
     *  omitting the option, means the gate holds no anchors; it does not mean
     *  "trust anyone". */
    trustedIssuers?: string[];
    /** Explicit wildcard trust: admit a passport whose only authority is its own
     *  signature. Required to admit a self-signed credential; the result then
     *  carries the verifier's self-signed warning so an operator can see the
     *  basis on which the request was let through. Default false. Ignored when
     *  `trustedIssuers` is non-empty. */
    allowSelfSigned?: boolean;
    /** Uniform clock-skew option, threaded into verifyPassport. */
    clock?: CoreVerifyClockOptions;
}
export interface TrustPostureResult {
    /** True iff the passport verified AND the gate had a stated basis for
     *  accepting whoever stands behind it. */
    ok: boolean;
    failure?: TrustPostureFailure;
    /** Human-readable detail for a deny reason or an audit log. Names the
     *  failing check; never carries key material. */
    detail?: string;
    errors: string[];
    warnings: string[];
}
/**
 * Run the shared execution-gate posture check on a presented passport.
 *
 * Pure and offline. Callers turn `ok: false` into whatever their transport
 * calls a denial, and should surface `detail` so an operator can tell an
 * untrusted issuer apart from a broken signature.
 */
export declare function checkPassportTrustPosture(passport: SignedPassport, opts?: TrustPostureOptions): TrustPostureResult;
//# sourceMappingURL=trust-posture.d.ts.map