/**
 * ✍️ THE CONSENT CERTIFICATE — GDPR-grade consent that BOTH the data subject and the data controller can prove.
 *
 * Consent today is a checkbox in a database the user can't see and the company can rewrite. Neither side has a
 * portable, tamper-evident record of what was actually agreed — so a subject can't prove their data was used outside
 * what they allowed, and a controller can't prove a given use WAS allowed. This makes consent a two-party signed
 * artifact: the SUBJECT signs a scoped grant (which purposes, which data fields, an expiry); the CONTROLLER, to use
 * the data, issues a Use Certificate whose verdict (ALLOWED / DENIED) is deterministically RE-DERIVED from the grant
 * — purpose in scope, fields in scope, not expired, not revoked — and signed. The subject can revoke (signed), and
 * any use after that is provably DENIED. Anyone can re-check the whole chain offline.
 *
 * WHO BENEFITS (≥2 parties, by design): ① the DATA SUBJECT holds a signed record of exactly what they consented to
 * and can PROVE any out-of-scope / expired / post-revocation use — real recourse, not a support ticket; ② the
 * CONTROLLER holds signed Use Certificates proving each use was within consent — an audit-ready compliance trail
 * that bounds liability. Neither can quietly rewrite the agreement.
 *
 * WORLD-FIRST + LLM-impossible: an LLM cannot bind a scoped grant to a subject key, deterministically adjudicate a
 * use against it, honour a signed revocation, and emit a re-derivable verdict — it just says "looks fine". (DIAKRISIS
 * — MEASURED: an in-scope use is ALLOWED + the use-cert verifies; an out-of-scope purpose / field, an expired use,
 * and a post-revocation use are each DENIED and NAMED; a use BEFORE a later revocation stays ALLOWED; a controller
 * forging ALLOWED for an out-of-scope use is rejected on re-derivation; subject≠controller two-party chain holds.
 * HONEST: this certifies consent SCOPE + that the record wasn't tampered — it cannot enforce what a controller does
 * off-system; its force is that an off-scope use is now provable, not that it is physically prevented.)
 */
import { type KeyObject } from "node:crypto";
export interface ConsentReceipt {
    standard: "melete-consent-receipt/v1";
    subject: string;
    controller: string;
    purposes: string[];
    fields: string[];
    grantedAt: number;
    expiresAt: number;
    payloadHash: string;
    signature: string;
    publicKeyPem: string;
    algo: "ed25519+sha256";
}
export interface ConsentRevocation {
    standard: "melete-consent-revocation/v1";
    receiptHash: string;
    revokedAt: number;
    payloadHash: string;
    signature: string;
    publicKeyPem: string;
    algo: "ed25519+sha256";
}
export interface ConsentUse {
    purpose: string;
    fields: string[];
    atTime: number;
}
export interface UseCertificate {
    standard: "melete-consent-use/v1";
    receiptHash: string;
    revocationHash: string | null;
    use: ConsentUse;
    verdict: "ALLOWED" | "DENIED";
    reasons: string[];
    subjectFingerprint: string;
    controllerFingerprint: string;
    payloadHash: string;
    signature: string;
    publicKeyPem: string;
    algo: "ed25519+sha256";
}
export declare function consentReceipt(opts: {
    subject?: string;
    controller?: string;
    purposes: string[];
    fields: string[];
    grantedAt?: number;
    expiresAt: number;
    keys?: {
        publicKey: KeyObject;
        privateKey: KeyObject;
    };
}): ConsentReceipt;
export declare function verifyConsentReceipt(r: ConsentReceipt): {
    ok: boolean;
    reason: string;
};
export declare function consentRevocation(opts: {
    receipt: ConsentReceipt;
    revokedAt: number;
    keys?: {
        publicKey: KeyObject;
        privateKey: KeyObject;
    };
}): ConsentRevocation;
export declare function checkUse(r: ConsentReceipt, use: ConsentUse, revocation?: ConsentRevocation | null): {
    verdict: "ALLOWED" | "DENIED";
    reasons: string[];
};
export declare function useCertificate(opts: {
    receipt: ConsentReceipt;
    use: ConsentUse;
    revocation?: ConsentRevocation | null;
    keys?: {
        publicKey: KeyObject;
        privateKey: KeyObject;
    };
}): UseCertificate;
export declare function verifyUseCertificate(uc: UseCertificate, receipt: ConsentReceipt, revocation?: ConsentRevocation | null): {
    ok: boolean;
    reason: string;
};
export declare function consentGauntlet(): {
    score: 0 | 100;
    checks: Array<{
        name: string;
        pass: boolean;
        detail: string;
    }>;
};
//# sourceMappingURL=consent.d.ts.map