/**
 * 🚫 THE REVOCATION REGISTRY — CRL/OCSP for AI certificates: withdraw a claim that turned out to be wrong.
 *
 * Every certificate in the stack is, once signed, valid forever — but real trust needs the opposite power too. A
 * model certified "fair" last quarter is found to discriminate; a signing key is compromised; an audit is later shown
 * to have used the wrong test set. Web PKI solved this with Certificate Revocation Lists / OCSP. This is that for AI
 * claims: an AUTHORITY (the issuer self-revoking, or a designated governance / witness-quorum key) appends a signed
 * revocation — the certificate's payloadHash + a reason + an effective timestamp — to a hash-chained, authority-signed
 * registry. A relying party then checks status before acting: GOOD, or REVOKED (with the reason and since-when).
 *
 * The crucial property is TIME-AWARENESS: a decision that relied on a certificate BEFORE its revocation took effect
 * is still historically valid (you did not act on bad information at the time) — only reliance AT/AFTER the effective
 * time is blocked. And because the registry is hash-chained + signed (and can itself be posted to the R50/R52
 * transparency log), a revocation cannot be silently dropped or back-dated: removing or altering one changes the head
 * the world already saw.
 *
 * WHO BENEFITS (≥4): ① the ISSUER can withdraw a faulty claim, bounding ongoing liability; ② RELYING PARTIES stop
 * acting on a certificate that is no longer valid; ③ REGULATORS can require revocation and verify it took effect;
 * ④ END USERS are protected from decisions made on a certificate that was already revoked.
 *
 * (DIAKRISIS — MEASURED: an un-revoked certificate checks GOOD; a revoked one checks REVOKED with the reason + the
 * since-time; status is TIME-AWARE [reliance before the effective time is GOOD, at/after is REVOKED]; the registry is
 * authority-signed and chain-linked, so altering an entry, forging a revocation, or dropping one is caught, and only
 * the DESIGNATED authority key is trusted [a revocation signed by anyone else is rejected]; deterministic + total.
 * HONEST: revocation only protects a relying party who actually CHECKS the registry [exactly like OCSP], and "who may
 * revoke" is an authority/governance policy choice — the registry enforces that whoever it is, their revocations are
 * signed, time-stamped and un-droppable, not who that authority ought to be.)
 */
import { type KeyObject } from "node:crypto";
export interface RevocationEntry {
    seq: number;
    certHash: string;
    reason: string;
    revokedAt: number;
    prevHash: string;
    entryHash: string;
}
export interface RevocationList {
    standard: "melete-revocation-list/v1";
    authority: string;
    authorityFingerprint: string;
    entries: RevocationEntry[];
    headHash: string;
    signature: string;
    publicKeyPem: string;
    algo: "ed25519+sha256";
}
export interface RevocationRegistry {
    authorityFingerprint: string;
    publicKeyPem: string;
    revoke: (certHash: string, reason: string, revokedAt: number) => RevocationEntry;
    status: (certHash: string, atTime?: number) => {
        status: "GOOD" | "REVOKED";
        reason: string | null;
        since: number | null;
    };
    list: () => RevocationList;
}
export declare function createRevocationRegistry(opts?: {
    authority?: string;
    keys?: {
        publicKey: KeyObject;
        privateKey: KeyObject;
    };
}): RevocationRegistry;
export declare function verifyRevocationList(l: RevocationList, trustedAuthorityPem?: string): {
    ok: boolean;
    reason: string;
};
export declare function statusFromList(l: RevocationList, certHash: string, atTime?: number): {
    status: "GOOD" | "REVOKED";
    reason: string | null;
    since: number | null;
};
export declare function revocationGauntlet(): {
    score: 0 | 100;
    checks: Array<{
        name: string;
        pass: boolean;
        detail: string;
    }>;
};
//# sourceMappingURL=revocation.d.ts.map