import type { SignedPassport, VerificationResult, Challenge } from '../types/passport.js';
import type { CoreVerifyClockOptions } from '../types/policy.js';
/**
 * Verify passport structural integrity and signature.
 *
 * WARNING: without `trustedIssuers`, a self-signed passport still returns
 * valid: true. A passport signature verifies under the public key the
 * passport itself carries, so on its own it proves that the holder of that
 * key wrote the passport, capabilities included, and nothing about who
 * vouches for the holder. A self-signed passport declaring
 * `admin:everything` verifies here.
 *
 * That default is UNCHANGED and is relied on across the SDK; flipping it is
 * a protocol decision, not a local repair. What this function now does is
 * report the state in a form a caller can branch on: `issuerTrustChecked`
 * says whether a trust root was consulted, and `selfSignedAccepted` says
 * that the verdict rests on the passport's own signature alone. Callers
 * that must not act on a self-vouching credential read those fields; the
 * relying-party gate (v2/offline-verifier/middleware) and
 * verifySocialContract both do, and both refuse to admit on that basis
 * without an explicit posture from their own caller.
 */
export declare function verifyPassport(signed: SignedPassport, opts?: {
    trustedIssuers?: string[];
    /** Accept a passport that carries no issuer countersignature, on its own
     *  signature alone. Off by default, and consulted only when
     *  `trustedIssuers` was not supplied: a caller that named issuers asked
     *  for that check, and this flag does not rescue a failed one. */
    allowSelfSigned?: boolean;
    /** M4. Uniform clock-skew option. When provided, passport expiry is
     *  tolerated within `allowedClockSkewMs` of the verifier clock. Omitting
     *  it preserves the prior exact-boundary behavior. This consolidates the
     *  per-verifier skews in ap2 (`clock_skew_seconds`) and
     *  instruction-provenance (`clockSkewMs`); those remain available. */
    clock?: CoreVerifyClockOptions;
}): VerificationResult;
export declare function createChallenge(expiresInSeconds?: number): Challenge;
export declare function verifyChallenge(challenge: Challenge, signatureHex: string, publicKeyHex: string): boolean;
//# sourceMappingURL=verify.d.ts.map