/**
 * The deterministic verifier (TypeScript port). Same checks, same verdict shape,
 * and the same security model as Python.
 *
 * SECURITY MODEL: a valid signature proves integrity, not authority. Pin the
 * issuer with `trustedKeys`. Without `trustedKeys` and without
 * `allowUnverifiedIssuer: true`, verify FAILS CLOSED (denies). Absent scope is
 * denied, empty allow-lists mean "allow nothing", unknown constraint keys are
 * denied, and amounts must be integers (compared like-for-like; caller picks the unit).
 */
import { type SignedMandate } from "./signing.ts";
export interface Transaction {
    merchant?: string;
    category?: string;
    amount?: {
        value: number;
        currency: string;
    };
    description?: string;
}
export type IntentScorer = (intent: string, transaction: Transaction) => number;
export type TrustedKeys = string | Buffer | Array<string | Buffer>;
interface Check {
    constraint: string;
    passed: boolean;
    detail: string;
}
export interface Verdict {
    decision: "allow" | "deny";
    signature_valid: boolean;
    scope_match_score: number;
    intent_alignment: number | null;
    matched: Check[];
    failed: Check[];
    rationale: string;
    mandate_id: string | undefined;
}
export interface VerifyOptions {
    now?: Date;
    intentScorer?: IntentScorer;
    intentThreshold?: number;
    trustedKeys?: TrustedKeys;
    allowUnverifiedIssuer?: boolean;
}
export declare function verify(signed: SignedMandate, transaction: Transaction, opts?: VerifyOptions): Verdict;
export {};
//# sourceMappingURL=verifier.d.ts.map