/**
 * 🏛️ THE CHAIN OF TRUST — verifiable AUTHORITY DELEGATION for AI claims (an "AI Certificate Authority").
 *
 * Every other module in the stack proves a claim is internally sound and signed — but it assumes the issuer's KEY is
 * one you should trust. The honest gaps we kept flagging (R51 witness, R53 revocation) were the same gap: *who is
 * actually authorized to issue — or revoke — this claim?* This is the PKI answer. A pinned ROOT authority signs a
 * scoped DELEGATION to an intermediate (which cert KINDS it may certify, which subject NAMESPACE, a validity window,
 * and a max remaining PATH LENGTH); the intermediate may delegate further — but only ever NARROWER — down to a leaf
 * issuer. A relying party pins ONE root public key and verifies that the issuer of any certificate was transitively
 * authorized to make exactly this claim: right kind, in-namespace, in-time, within path budget, every link signed by
 * the previous delegate's key, and no link broader than its parent. Over-delegation, out-of-scope kind, out-of-
 * namespace subject, an expired link, an exceeded path length, a broken or forged link — all rejected, naming the
 * failing link.
 *
 * WHO BENEFITS (≥4): ① the ROOT authority (a regulator / standards body) sets policy ONCE and every downstream
 * issuer inherits a checkable, bounded mandate; ② INTERMEDIATE authorities get real, scoped power they can prove and
 * sub-delegate without becoming a root; ③ ISSUERS can prove they were authorized to make a claim, not merely that
 * they signed it; ④ RELYING PARTIES trust a whole ecosystem by pinning ONE key, and ⑤ end users are protected from a
 * rogue or over-reaching issuer whose claim falls outside its mandate.
 *
 * (DIAKRISIS — MEASURED: a well-formed root→intermediate→leaf chain authorizes an in-scope claim; a chain not anchored
 * at the pinned root, an out-of-kind claim, an out-of-namespace subject, an expired link [time-aware — before expiry
 * still authorizes], a path length beyond budget, a broken issuer→subject link, a tampered/forged link, and a link
 * that tries to BROADEN beyond its parent are all rejected naming the link; deterministic + total. HONEST: this proves
 * the issuer was AUTHORIZED under the pinned root's policy — it does not make the underlying claim true [that is the
 * cert's own job], and trust still bottoms out at the ONE root you choose to pin. Revocation of a delegation rides on
 * the existing revocation registry [R53]; this module decides scope + chain, not liveness.)
 */
import { type KeyObject } from "node:crypto";
/** Fingerprint of an Ed25519 public key (SPKI PEM) — the identifier used throughout delegations. */
export declare function fingerprintOf(publicKey: KeyObject): string;
export interface DelegationScope {
    kinds: string[] | "*";
    namespace: string;
    maxPathLen: number;
}
export interface Delegation {
    standard: "melete-delegation/v1";
    issuerFingerprint: string;
    subjectFingerprint: string;
    scope: DelegationScope;
    notBefore: number;
    notAfter: number;
    delegationId: string;
    payloadHash: string;
    signature: string;
    issuerPublicKeyPem: string;
    algo: "ed25519+sha256";
}
/** Sign a scoped delegation from `parent` (the issuer key) granting authority to `subjectFingerprint`. */
export declare function delegate(opts: {
    parent: {
        publicKey: KeyObject;
        privateKey: KeyObject;
    };
    subjectFingerprint: string;
    scope: DelegationScope;
    notBefore?: number;
    notAfter?: number;
}): Delegation;
/** A single delegation re-verifies (signature + bound hash + issuer fingerprint matches its own key). */
export declare function verifyDelegation(d: Delegation): {
    ok: boolean;
    reason: string;
};
/**
 * The relying-party check: pin ONE root fingerprint and verify the claim's issuer was transitively authorized.
 * `chain` is ordered root→…→leaf (each link's issuer is the previous link's subject; the first link's issuer is the root).
 */
export declare function verifyAuthorization(chain: Delegation[], pinnedRootFingerprint: string, claim: {
    issuerFingerprint: string;
    kind: string;
    subjectName: string;
    atTime: number;
}): {
    ok: boolean;
    reason: string;
    effectiveScope?: DelegationScope;
};
export declare function authorityGauntlet(): {
    score: 0 | 100;
    checks: Array<{
        name: string;
        pass: boolean;
        detail: string;
    }>;
};
//# sourceMappingURL=authority.d.ts.map