/**
 * @file Package provenance and attestation verification utilities.
 */
import type { ProvenanceOptions } from './types';
/**
 * Comparator ordering two trust statuses by ascending trust level. Sorts an
 * array of statuses lowest-trust-first; negate for highest-first.
 */
export declare function compareTrust(a: TrustStatus, b: TrustStatus): -1 | 0 | 1;
/**
 * Whether `next` sits at a lower trust level than `prev` — i.e. a release
 * regressed its supply-chain posture. Drives the post-publish provenance
 * reminder: a version that drops from trustedPublisher back to bare provenance
 * is a red flag worth surfacing.
 */
export declare function didTrustDecrease(prev: TrustStatus, next: TrustStatus): boolean;
/**
 * Fetch package provenance information from npm registry.
 *
 * @example
 *   ;```typescript
 *   const provenance = await fetchPackageProvenance('lodash', '4.17.21')
 *   ```
 */
export declare function fetchPackageProvenance(pkgName: string, pkgVersion: string, options?: ProvenanceOptions): Promise<unknown>;
/**
 * Find the first attestation with valid provenance data.
 */
export declare function findProvenance(attestations: unknown[]): unknown;
/**
 * Extract and filter SLSA provenance attestations from attestation data.
 */
export declare function getAttestations(attestationData: unknown): unknown[];
export declare function getFetcher(): import("../external/make-fetch-happen").MakeFetchHappen;
/**
 * Convert raw attestation data to user-friendly provenance details.
 *
 * @example
 *   ;```typescript
 *   const details = getProvenanceDetails(attestationData)
 *   // { level: 'trusted', repository: '...', commitSha: '...' }
 *   ```
 */
export declare function getProvenanceDetails(attestationData: unknown): unknown;
/**
 * Map a trust status to its 0..3 ladder level.
 */
export declare function getTrustLevel(status: TrustStatus): TrustLevel;
/**
 * Map a trust status to its human-readable level name.
 */
export declare function getTrustLevelName(status: TrustStatus): TrustLevelName;
/**
 * Extract provenance / trusted-publisher / staged-publish flags from a registry
 * version document.
 *
 * Staged-publish detection follows pnpm/pnpm#12056: `_npmUser.approver` is set
 * by the registry when a package version was promoted out of staging via a
 * 2FA-gated approve step. That signal ranks ABOVE both `trustedPublisher` and
 * `provenance` in pnpm's trust-evidence ladder, because it adds a human
 * approval gate on top of the OIDC publisher identity.
 */
export declare function getTrustStatus(meta: unknown): TrustStatus;
/**
 * Check if a value indicates a trusted publisher (GitHub or GitLab).
 */
export declare function isTrustedPublisher(value: unknown): boolean;
/**
 * Trust signals derived from a registry version document.
 */
export interface TrustStatus {
    provenance: boolean;
    trustedPublisher: boolean;
    stagedPublish: boolean;
}
/**
 * Trust ladder, low → high. The index IS the level (0..3), so a single array
 * maps both directions: `TRUST_LEVELS[level]` → name, and
 * `TRUST_LEVELS.indexOf(name)` → level. One source of truth, no parallel Record
 * to keep in sync.
 */
export declare const TRUST_LEVELS: readonly ['none', 'provenance', 'trustedPublisher', 'stagedPublish'];
export type TrustLevel = 0 | 1 | 2 | 3;
export type TrustLevelName = (typeof TRUST_LEVELS)[number];
