/**
 * Cognitum product-plane claim federation primitives.
 *
 * This module intentionally contains no grant-verification or domain mutation
 * logic. It validates the portable, reference-only envelope that a local
 * policy enforcement point can evaluate before consulting its authoritative
 * identity, tenancy, and permission stores.
 */
import { type KeyLike } from 'node:crypto';
export declare const PRODUCT_ACTION_ENVELOPE_VERSION: "cognitum.action.v1";
export declare const PRODUCT_ACTIONS: readonly ["dashboard.read", "dashboard.status.read", "inference.invoke", "inference.stream", "usage.read", "pod.spawn", "benchmark.run", "evolution.propose", "evolution.promote", "comms.thread.read", "comms.thread.post", "comms.projection.read", "comms.board.admin", "cog.proposal.create", "cog.proposal.review", "cog.proposal.approve", "cog.instance.acquire", "cog.instance.operate", "cog.deploy", "cog.rollback", "ruview.space.read", "ruview.semantic.publish", "ruview.automation.propose", "ruview.automation.approve", "ruview.device.command", "cognition.route", "cognition.critique", "memory.recall", "memory.propose", "evidence.read", "memory.commit-validated"];
export type ProductAction = (typeof PRODUCT_ACTIONS)[number];
export declare const PRODUCT_AUTHORITIES: readonly ["cognitum.control-plane", "cognitum.cog", "meta-llm", "comms", "agentbbs", "ruview.edge", "ruflo.policy", "ruflo.memory"];
export type ProductAuthority = (typeof PRODUCT_AUTHORITIES)[number];
export declare const IDENTITY_NAMESPACES: readonly ["cognitum-principal", "firebase-subject", "meta-llm-account", "agentbbs-public-key", "workload", "ruflo-agent", "legacy-principal"];
export type IdentityNamespace = (typeof IDENTITY_NAMESPACES)[number];
export declare const TENANT_NAMESPACES: readonly ["cognitum-tenant", "meta-llm-account", "meta-llm-sub-tenant", "comms-tenant", "agentbbs-board", "ruview-space"];
export type TenantNamespace = (typeof TENANT_NAMESPACES)[number];
export type PrivacyClass = 'P0' | 'P1' | 'P2' | 'P3';
export interface NamespacedIdentity {
    namespace: IdentityNamespace;
    id: string;
}
export interface NamespacedTenantRef {
    namespace: TenantNamespace;
    id: string;
}
export interface AuthoritativeReference {
    authority: ProductAuthority;
    tenantRef: NamespacedTenantRef;
    /**
     * Authority-qualified record kind, for example
     * `meta-llm/inference` or `ruview.edge/semantic-observation`.
     */
    sourceType: string;
    sourceId: string;
    sourceVersion: string;
    sourceDigest: `sha256:${string}`;
}
export interface ProductActionEnvelopeV1 {
    schemaVersion: typeof PRODUCT_ACTION_ENVELOPE_VERSION;
    eventId: string;
    issuer: ProductAuthority;
    audience: ProductAuthority;
    subject: NamespacedIdentity;
    actor?: NamespacedIdentity;
    tenantRef: NamespacedTenantRef;
    action: ProductAction;
    resourceRefs: string[];
    requestDigest?: `sha256:${string}`;
    contentDigest?: `sha256:${string}`;
    idempotencyKey?: string;
    correlationId: string;
    causationId?: string;
    authoritativeSource: AuthoritativeReference;
    sequence?: string;
    policyReceiptId: string;
    capabilityId?: string;
    validationReceiptId?: string;
    occurredAt: string;
    expiresAt?: string;
    privacyClass: PrivacyClass;
}
export type AvailabilityCheck = 'yes' | 'no' | 'unknown';
export type IdentityAvailability = 'verified' | 'unverified' | 'invalid' | 'unknown';
/**
 * Independent integration-health dimensions. In particular, an authorized
 * claim changes only `authorized`; it does not imply configuration,
 * reachability, service health, or verified browser/workload identity.
 */
export interface ProductAvailabilityDimensions {
    identity: IdentityAvailability;
    configured: AvailabilityCheck;
    reachable: AvailabilityCheck;
    healthy: AvailabilityCheck;
    authorized: AvailabilityCheck;
}
export type ProductAvailability = 'available' | 'degraded' | 'blocked' | 'unavailable';
export declare function classifyProductAvailability(dimensions: ProductAvailabilityDimensions): ProductAvailability;
export interface RuViewSemanticObservationV1 {
    schemaVersion: 'ruview.semantic-observation.v1';
    spaceRef: NamespacedTenantRef & {
        namespace: 'ruview-space';
    };
    observationType: string;
    /**
     * Privacy-minimized semantic data only. Binary values, arrays, and raw
     * sensing field names are rejected by the wire validator.
     */
    value: Record<string, string | number | boolean | null>;
    confidence: number;
    uncertainty?: number;
    abstained: boolean;
    modelDigest: `sha256:${string}`;
    calibrationDigest?: `sha256:${string}`;
    hardwareRef?: string;
    privacyClass: 'P2' | 'P3';
    observedAt: string;
    expiresAt: string;
    /** Canonical unsigned decimal string; JSON cannot safely carry bigint. */
    sequence: string;
}
export interface ValidationIssue {
    path: string;
    code: 'invalid_type' | 'missing' | 'unknown_field' | 'unsupported_value' | 'invalid_format' | 'invalid_authority' | 'identity_namespace_required' | 'tenant_mismatch' | 'privacy_ceiling_exceeded';
    message: string;
}
export type ValidationResult<T> = {
    ok: true;
    value: T;
} | {
    ok: false;
    issues: ValidationIssue[];
};
export interface ProductActionRequirements {
    requestDigest: boolean;
    contentDigest: boolean;
    idempotencyKey: boolean;
    expiry: boolean;
    capability: boolean;
    validationReceipt: boolean;
}
/**
 * Actions must be anchored in the product that owns their authoritative
 * outcome. Read-model actions permit the explicitly listed source domains.
 */
export declare const ACTION_AUTHORITIES: Readonly<Record<ProductAction, readonly ProductAuthority[]>>;
/**
 * Explicit obligations avoid inference from action spelling. New actions do
 * not become privileged merely because a caller supplies a valid signature.
 */
export declare const PRODUCT_ACTION_REQUIREMENTS: Readonly<Record<ProductAction, ProductActionRequirements>>;
export declare function identityKey(identity: NamespacedIdentity): string;
export declare function sameIdentity(left: NamespacedIdentity, right: NamespacedIdentity): boolean;
export declare function tenantRefKey(tenant: NamespacedTenantRef): string;
export declare function isProductAction(value: unknown): value is ProductAction;
export declare function validateAuthoritativeReference(input: unknown, options?: {
    action?: ProductAction;
    tenantRef?: NamespacedTenantRef;
}): ValidationResult<AuthoritativeReference>;
export declare function validateProductActionEnvelope(input: unknown): ValidationResult<ProductActionEnvelopeV1>;
export type RuViewSemanticFieldKind = 'boolean' | 'number' | 'string' | 'nullable-string';
export interface RuViewSemanticFieldSchema {
    kind: RuViewSemanticFieldKind;
    required?: boolean;
    min?: number;
    max?: number;
    maxLength?: number;
    enum?: readonly string[];
}
export interface RuViewObservationSchema {
    privacyClasses: readonly ('P2' | 'P3')[];
    fields: Readonly<Record<string, RuViewSemanticFieldSchema>>;
}
export type RuViewObservationRegistry = Readonly<Record<string, RuViewObservationSchema>>;
/**
 * The default edge-export surface is deliberately small and semantic. A new
 * observation type or field requires explicit schema registration; arbitrary
 * keys are never accepted based on a deny-list alone.
 */
export declare const DEFAULT_RUVIEW_OBSERVATION_REGISTRY: RuViewObservationRegistry;
export declare function validateRuViewSemanticObservation(input: unknown, registry?: RuViewObservationRegistry): ValidationResult<RuViewSemanticObservationV1>;
/**
 * RFC 8785/JCS-compatible canonical JSON for this I-JSON profile.
 *
 * ECMAScript's JSON number serialization supplies the JCS number rendering.
 * Non-finite numbers, sparse arrays, undefined values, non-plain objects, and
 * invalid Unicode are rejected instead of being silently coerced.
 */
export declare function canonicalizeProductPlane(value: unknown): string;
export declare function canonicalProductPlaneBytes(value: unknown): Uint8Array;
export declare function canonicalProductPlaneDigest(value: unknown): `sha256:${string}`;
export interface SignedProductActionEnvelopeV1 {
    envelope: ProductActionEnvelopeV1;
    algorithm: 'Ed25519';
    keyId: string;
    signature: string;
}
export type SignatureVerifier = (input: {
    issuer: ProductAuthority;
    keyId: string;
    algorithm: 'Ed25519';
    canonicalBytes: Uint8Array;
    signature: Uint8Array;
}) => boolean | Promise<boolean>;
export type AuthorityKeyResolver = (issuer: ProductAuthority, keyId: string) => KeyLike | null | undefined | Promise<KeyLike | null | undefined>;
export interface ReplayReservationInput {
    key: string;
    bindingDigest: `sha256:${string}`;
    expiresAt: number;
}
export type ReplayReservation = 'reserved' | 'replay' | 'conflict';
/**
 * The implementation must reserve atomically. A lookup-then-insert adapter is
 * not a conforming replay store under concurrent delivery.
 */
export interface ProductEnvelopeReplayStore {
    reserve(input: ReplayReservationInput): ReplayReservation | Promise<ReplayReservation>;
}
export type LocalAuthorizationDecision = boolean | {
    allowed: boolean;
    reason?: string;
};
export interface ProductEnvelopeVerifierOptions {
    expectedAudience: ProductAuthority;
    expectedTenantRef: NamespacedTenantRef;
    now?: () => number;
    maxAgeMs?: number;
    maxFutureSkewMs?: number;
    resolveKey?: AuthorityKeyResolver;
    verifySignature?: SignatureVerifier;
    replayStore: ProductEnvelopeReplayStore;
    policyVerifier: (envelope: ProductActionEnvelopeV1) => LocalAuthorizationDecision | Promise<LocalAuthorizationDecision>;
    capabilityVerifier: (envelope: ProductActionEnvelopeV1) => LocalAuthorizationDecision | Promise<LocalAuthorizationDecision>;
}
export type ProductEnvelopeVerificationCode = 'malformed_signed_envelope' | 'invalid_envelope' | 'audience_mismatch' | 'tenant_mismatch' | 'not_yet_valid' | 'stale' | 'expired' | 'signature_configuration_missing' | 'key_not_found' | 'signature_invalid' | 'policy_denied' | 'capability_denied' | 'replay_detected' | 'idempotency_conflict' | 'verification_error';
export type ProductEnvelopeVerificationResult = {
    ok: true;
    envelope: ProductActionEnvelopeV1;
    canonicalDigest: `sha256:${string}`;
    replayKey: string;
} | {
    ok: false;
    code: ProductEnvelopeVerificationCode;
    reason: string;
    issues?: ValidationIssue[];
};
/**
 * Verify a signed product action as an ingress policy-enforcement decision.
 *
 * Signature validity is necessary but insufficient: audience, tenant,
 * freshness, replay state, local policy, and the action-bound capability are
 * checked independently. Service availability is intentionally absent; a
 * valid claim never implies that its target is configured, reachable, or
 * healthy.
 */
export declare function verifySignedProductActionEnvelope(input: unknown, options: ProductEnvelopeVerifierOptions): Promise<ProductEnvelopeVerificationResult>;
//# sourceMappingURL=product-plane.d.ts.map