/**
 * 🎫 THE TRUST PASSPORT — ship the whole proof as ONE signed bundle; verify everything in a single call.
 *
 * The honesty stack has grown to many certificates. In real life a vendor doesn't want to hand a buyer eight
 * separate JSON files, and a regulator doesn't want to verify them one by one. The Trust Passport composes any set
 * of Melete certificates into ONE signed envelope: it binds each member by its hash into a merkle root, signs the
 * root, and re-verifies every member offline in a single call. Because the passport itself has the standard signed
 * shape, the two-party Verification Receipt (a verifier counter-signs it) works on it unchanged — so an auditor can
 * confirm the entire bundle and hand back one counter-signed receipt.
 *
 * WHO BENEFITS (≥2 parties, by design): ① the ISSUER (an AI vendor / deployer) ships a single portable artifact that
 * proves fairness AND calibration AND privacy AND the SLA AND consent at once — and a tampered or swapped member is
 * caught; ② the VERIFIER (a buyer / regulator / procurement) verifies the whole compliance posture in one offline
 * call instead of chasing eight files, and gets an exact list of which member (if any) failed.
 *
 * (DIAKRISIS — MEASURED: a passport over genuine members verifies and reports overall PASS; swapping or tampering
 * any member is caught and named; the merkle root is order-independent; a member whose embedded certificate's hash
 * doesn't match the manifest is rejected; a forged "all-verified" passport with a failing member is rejected on
 * re-derivation; the passport is itself a signed cert so the two-party Verification Receipt verifies over it. HONEST:
 * the passport is exactly as strong as the member certificates it carries — it composes + binds + makes one-call
 * verification possible; it does not add new statistical power, and it needs the per-kind verifier to re-derive
 * members [injected], so a kind the verifier doesn't know is reported UNKNOWN, not silently trusted.)
 */
import { type KeyObject } from "node:crypto";
interface SignedCert {
    standard?: string;
    payloadHash?: string;
}
type VerifyFn = (kind: string, cert: any) => {
    ok: boolean;
    reason: string;
};
interface PassportEntry {
    kind: string;
    certHash: string;
    standard: string;
    ok: boolean;
    reason: string;
}
export interface TrustPassport {
    standard: "melete-trust-passport/v1";
    issuer: string;
    subject: string;
    n: number;
    entries: PassportEntry[];
    merkleRoot: string;
    overallVerified: boolean;
    certificates: any[];
    payloadHash: string;
    signature: string;
    publicKeyPem: string;
    algo: "ed25519+sha256";
}
export declare function trustPassport(opts: {
    issuer?: string;
    subject?: string;
    members: Array<{
        kind: string;
        certificate: SignedCert;
    }>;
    verify: VerifyFn;
    keys?: {
        publicKey: KeyObject;
        privateKey: KeyObject;
    };
}): TrustPassport;
export declare function verifyTrustPassport(p: TrustPassport, verify: VerifyFn): {
    ok: boolean;
    reason: string;
};
export declare function passportGauntlet(): {
    score: 0 | 100;
    checks: Array<{
        name: string;
        pass: boolean;
        detail: string;
    }>;
};
export {};
//# sourceMappingURL=passport.d.ts.map