/**
 * RecourseOS Attestation Verification Library
 *
 * Standalone library for verifying attestations without RecourseOS dependency.
 * Implements verification procedure from §7.4 of the attestation protocol.
 *
 * @example
 * ```typescript
 * import { verifyAttestation } from 'recourse-verify';
 *
 * const result = await verifyAttestation(attestation, {
 *   trustedInstances: ['https://recourse.example'],
 * });
 *
 * if (result.valid) {
 *   console.log('Attestation verified');
 * } else {
 *   console.log('Verification failed:', result.reason);
 * }
 * ```
 *
 * @module verify
 */
/**
 * Attestation structure as defined in the protocol
 */
export interface Attestation {
    input: unknown;
    output: unknown;
    evaluator: string;
    timestamp: string;
    key_id: string;
    attestation_uri: string;
    signature: string;
}
/**
 * Key entry in the registry
 */
export interface KeyEntry {
    key_id: string;
    algorithm: string;
    public_key: string;
    state: 'pending' | 'active' | 'deprecated' | 'retired' | 'compromised';
    valid_from?: string;
    valid_until?: string | null;
    deprecated_at?: string;
}
/**
 * Key registry structure
 */
export interface KeyRegistry {
    /** Version of the registry format */
    version: 1;
    /** Monotonically increasing sequence number for rollback protection */
    sequence: number;
    keys: KeyEntry[];
    updated_at: string;
}
/**
 * Verification options
 */
export interface VerifyOptions {
    /**
     * List of trusted instance base URLs. If non-empty, only attestations
     * from these instances will be accepted. Empty means accept any.
     */
    trustedInstances?: string[];
    /**
     * Cache TTL in milliseconds. Default: 86400000 (24 hours)
     */
    keyCacheTtlMs?: number;
    /**
     * Perform cross-check by fetching attestation from URI. Default: false
     */
    crossCheck?: boolean;
    /**
     * Custom fetch function for testing or environments without global fetch
     */
    fetch?: typeof fetch;
}
/**
 * Verification result
 */
export type VerifyResult = {
    valid: true;
    keyId: string;
    keyState: string;
    timestamp: string;
} | {
    valid: false;
    reason: VerifyFailureReason;
    details?: string;
};
/**
 * Verification failure reasons per §7.6
 */
export type VerifyFailureReason = 'attestation_absent' | 'instance_not_trusted' | 'signature_invalid' | 'key_not_found' | 'key_compromised' | 'key_pending' | 'cross_check_mismatch' | 'network_error' | 'registry_rollback' | 'invalid_attestation';
/**
 * Clear the registry cache. Useful for testing.
 */
export declare function clearRegistryCache(): void;
/**
 * Canonicalize a value per RFC 8785 (JSON Canonicalization Scheme)
 */
export declare function canonicalize(value: unknown): string;
/**
 * Verify an attestation
 *
 * Implements the verification procedure from §7.4 of the attestation protocol.
 *
 * @param attestation - The attestation to verify
 * @param options - Verification options
 * @returns Verification result
 */
export declare function verifyAttestation(attestation: Attestation, options?: VerifyOptions): Promise<VerifyResult>;
/**
 * Verify multiple attestations
 *
 * Useful for batch verification. Pre-fetches all registries to ensure
 * consistency: all attestations are verified against the same registry
 * snapshot, preventing race conditions during registry rotation.
 *
 * @param attestations - Array of attestations to verify
 * @param options - Verification options
 * @returns Array of verification results
 */
export declare function verifyAttestations(attestations: Attestation[], options?: VerifyOptions): Promise<VerifyResult[]>;
//# sourceMappingURL=index.d.ts.map