/**
 * ✅ THE LIVE TRUST REPORT — one signed answer to the only question a non-expert actually asks: "is this AI
 * trustworthy RIGHT NOW?"
 *
 * The stack proves many things separately — a fairness cert, a private-audit proof, a model lineage, a per-answer
 * tag. A Trust Passport (R46) bundles them, but "all members verify" is a STATIC claim: a member could have been
 * REVOKED since (R53), or never actually posted to the public log (R50). This composes the whole lifecycle into a
 * single LIVE verdict: for every member certificate it checks three things at once — (1) it VERIFIES (re-derives +
 * signature), (2) it is NOT REVOKED as of the reliance time (time-aware), and (3) it is INCLUDED in the public
 * transparency log — and returns TRUSTED-NOW only if every member passes all three, else NOT-TRUSTED-NOW naming the
 * exact member and reason. It is signed, so the verdict itself is re-derivable offline.
 *
 * WHO BENEFITS (≥4): ① a non-expert CONSUMER / procurement gets ONE trustworthy-or-not answer instead of reading
 * eight proofs; ② the ISSUER shows a live-good report that already accounts for revocation + public logging; ③
 * REGULATORS get a single signed status that reflects the current world, not a stale bundle; ④ END USERS are
 * protected when any underlying claim is withdrawn or was never logged.
 *
 * (DIAKRISIS — MEASURED: when every member verifies, is un-revoked, and is logged, the report is TRUSTED-NOW; a
 * REVOKED member flips it to NOT-TRUSTED-NOW naming that member; an UNLOGGED member is flagged; a tampered member
 * fails verification; the verdict is TIME-AWARE [a report dated before a member's revocation is still TRUSTED]; a
 * forged TRUSTED-NOW is rejected on re-derivation; signed + deterministic + total. HONEST: the report is exactly as
 * strong as its inputs — it composes verification + revocation status + log inclusion, it does not itself judge the
 * model; "logged" requires a transparency-log inclusion proof to be supplied, and revocation requires the relevant
 * registry to be supplied [the report records WHICH registry/log head it was evaluated against].)
 */
import { type KeyObject } from "node:crypto";
import { type RevocationList } from "./revocation.js";
import { type SignedTreeHead, type InclusionProof } from "./translog.js";
type VerifyFn = (kind: string, cert: any) => {
    ok: boolean;
    reason: string;
};
export interface ReportMember {
    kind: string;
    certHash: string;
    verifies: boolean;
    revoked: boolean;
    logged: boolean | null;
    ok: boolean;
    reason: string;
}
export interface TrustReport {
    standard: "melete-trust-report/v1";
    subject: string;
    atTime: number;
    requireLogged: boolean;
    revocationHead: string | null;
    logRoot: string | null;
    members: ReportMember[];
    verdict: "TRUSTED-NOW" | "NOT-TRUSTED-NOW" | "EMPTY";
    failing: string[];
    certificates: any[];
    payloadHash: string;
    signature: string;
    publicKeyPem: string;
    algo: "ed25519+sha256";
}
export declare function buildTrustReport(opts: {
    subject?: string;
    members: Array<{
        kind: string;
        certificate: any;
        inclusion?: InclusionProof;
    }>;
    verify: VerifyFn;
    atTime?: number;
    revocationList?: RevocationList | null;
    logSTH?: SignedTreeHead | null;
    keys?: {
        publicKey: KeyObject;
        privateKey: KeyObject;
    };
}): TrustReport;
export declare function verifyTrustReport(r: TrustReport, verify: VerifyFn, opts?: {
    revocationList?: RevocationList | null;
    logSTH?: SignedTreeHead | null;
    inclusions?: InclusionProof[];
}): {
    ok: boolean;
    verdict: string;
    reason: string;
};
export declare function trustReportGauntlet(): {
    score: 0 | 100;
    checks: Array<{
        name: string;
        pass: boolean;
        detail: string;
    }>;
};
export {};
//# sourceMappingURL=trustreport.d.ts.map