/**
 * Insurance Certificate Signer — signed envelope of a AgentTrustReport.
 *
 * Per Thomas Layer 0 2026-05-06 trademark positioning:
 *   "The Sovereignty Certificate is the regulatory credential."
 *
 * Wraps a AgentTrustReport (slice 31) in a tamper-evident Ed25519-signed
 * envelope that downstream parties — partner orgs, insurers, auditors,
 * regulators — can verify without contacting our service.
 *
 * Verification is OFFLINE per Locked Invariant 4: cache the issuer
 * public key once, verify any number of certificates against it.
 *
 * Uses the same canonical-JSON serialisation as signed-manifest (W2.x
 * crypto), so signatures verify deterministically across SDKs.
 *
 * @connexum/ai-governance  Insurance Certificate / Sovereignty Credential
 */
import * as crypto from 'node:crypto';
import type { AgentTrustReport } from './agent-trust-report.js';
/** Maximum certificate age before verification rejects it. Default 90 days. */
export declare const DEFAULT_CERT_MAX_AGE_DAYS = 90;
export type CertificateClass = 
/** Routine compliance report, valid through period.to + max-age. */
'standard'
/** High-stakes certification (insurance underwriting, regulator submission). */
 | 'attested'
/** Pre-production / staging — not for production reliance. */
 | 'provisional';
export interface CertificatePayload {
    /** Issuing org (the customer running the platform). */
    issuerOrgId: string;
    /** Subject — the org whose agent the report covers. */
    subjectOrgId: string;
    /** Certificate class. */
    class: CertificateClass;
    /** Embedded compliance report. */
    report: AgentTrustReport;
    /** Random hex nonce, 32 chars. */
    nonce: string;
    /** ISO 8601 issuance time. */
    issuedAt: string;
    /** Optional ISO 8601 expiry — when absent, validity is period.to + max-age. */
    expiresAt?: string;
}
export interface InsuranceCertificate {
    payload: CertificatePayload;
    signature: string;
    alg: 'ed25519';
}
export interface IssueCertificateInput {
    report: AgentTrustReport;
    issuerOrgId: string;
    subjectOrgId?: string;
    certClass?: CertificateClass;
    privateKey: crypto.KeyObject;
    nowIso?: string;
    /** Optional explicit expiry override. */
    expiresAt?: string;
}
export declare function issueInsuranceCertificate(input: IssueCertificateInput): InsuranceCertificate;
export interface VerifyCertificateOptions {
    /** Expected issuer — protects against confused-deputy attacks. */
    expectedIssuerOrgId?: string;
    /** Override "now" for tests. */
    nowMs?: number;
    /** Max age in days before rejection. Default 90. */
    maxAgeDays?: number;
}
export interface CertificateVerifyError extends Error {
    code: 'INVALID_SIGNATURE' | 'EXPIRED' | 'MALFORMED' | 'ISSUER_MISMATCH' | 'NOT_YET_VALID';
}
/**
 * Verify a certificate offline against the issuer's cached public key.
 * Returns the validated payload OR throws CertificateVerifyError.
 *
 * Validity window:
 *   - explicit expiresAt if present
 *   - else issuedAt + maxAgeDays (default 90)
 * Plus issuedAt cannot be in the future beyond a 5-minute clock-skew tolerance.
 */
export declare function verifyInsuranceCertificate(cert: InsuranceCertificate, publicKey: crypto.KeyObject, options?: VerifyCertificateOptions): CertificatePayload;
/**
 * Compact certificate fingerprint for dashboard cards / partner-share links.
 * SHA-256 of the canonical payload, base64url first 16 chars.
 */
export declare function certificateFingerprint(cert: InsuranceCertificate): string;
//# sourceMappingURL=insurance-certificate.d.ts.map