/**
 * Transcript Signing
 *
 * Signs transcripts using Sigstore for keyless verification.
 * Generates in-toto provenance statements for audit compliance.
 *
 * @module transcripts/signing
 */
import type { SignedTranscript, TranscriptEntry } from "./logger.js";
/**
 * In-toto provenance statement for transcript
 */
export interface TranscriptProvenance {
    _type: "https://in-toto.io/Statement/v0.1";
    predicateType: "https://vaspera.dev/attestation/transcript/v1";
    subject: Array<{
        name: string;
        digest: {
            sha256: string;
        };
    }>;
    predicate: {
        sessionId: string;
        entryCount: number;
        rootHash: string;
        tipHash: string;
        startedAt: string;
        endedAt: string;
        hasRedactions: boolean;
        builderVersion: string;
        invocation?: {
            configSource?: {
                uri?: string;
                digest?: {
                    sha256: string;
                };
            };
        };
        metadata?: Record<string, unknown>;
    };
}
/**
 * Signed transcript bundle
 */
export interface TranscriptBundle {
    /** The signed transcript */
    transcript: SignedTranscript;
    /** In-toto provenance statement */
    provenance: TranscriptProvenance;
    /** Sigstore signature bundle */
    signature?: {
        /** Base64-encoded signature */
        sig: string;
        /** Certificate chain */
        cert?: string;
        /** Rekor log entry */
        rekorLogId?: string;
        /** Signature timestamp */
        signedAt: string;
    };
    /** Bundle creation timestamp */
    createdAt: string;
    /** Bundle format version */
    version: "1.0.0";
}
/**
 * Signing options
 */
export interface TranscriptSigningOptions {
    /** Include full entries in provenance (default: false) */
    includeEntries?: boolean;
    /** Additional metadata */
    metadata?: Record<string, unknown>;
    /** Skip actual Sigstore signing (for testing) */
    skipSigning?: boolean;
}
/**
 * Generate in-toto provenance statement for a transcript
 */
export declare function generateTranscriptProvenance(transcript: SignedTranscript, entries?: TranscriptEntry[], metadata?: Record<string, unknown>): TranscriptProvenance;
/**
 * Sign a transcript and generate a bundle
 */
export declare function signTranscript(transcript: SignedTranscript, entries?: TranscriptEntry[], options?: TranscriptSigningOptions): Promise<TranscriptBundle>;
/**
 * Save a signed transcript bundle to file
 */
export declare function saveTranscriptBundle(bundle: TranscriptBundle, filePath: string): Promise<void>;
/**
 * Load a transcript bundle from file
 */
export declare function loadTranscriptBundle(filePath: string): Promise<TranscriptBundle>;
/**
 * Sign multiple transcripts in a batch
 */
export declare function signTranscriptBatch(transcripts: Array<{
    transcript: SignedTranscript;
    entries?: TranscriptEntry[];
}>, options?: TranscriptSigningOptions): Promise<TranscriptBundle[]>;
/**
 * Check if transcript signing is available
 */
export declare function isTranscriptSigningAvailable(): Promise<boolean>;
/**
 * Generate a signature summary
 */
export declare function generateSigningSummary(bundle: TranscriptBundle): string;
//# sourceMappingURL=signing.d.ts.map