import type { JsonValue } from '../control-plane';
import type { SecurityPostureStore } from './posture-store';
import type { ReleaseSecurityArtifact, SecurityPostureFinding } from './types';
export interface CycloneDxComponent {
    type: 'application' | 'library' | 'container';
    name: string;
    version: string;
    purl?: string;
    scope?: 'required' | 'optional' | 'excluded';
    hashes?: Array<{
        alg: 'SHA-256';
        content: string;
    }>;
}
export interface CycloneDxDocument {
    bomFormat: 'CycloneDX';
    specVersion: '1.5';
    serialNumber: string;
    version: 1;
    metadata: {
        timestamp: string;
        component: CycloneDxComponent;
        tools: Array<{
            vendor: string;
            name: string;
            version: string;
        }>;
    };
    components: CycloneDxComponent[];
}
export interface ReleaseProvenance {
    _type: 'https://in-toto.io/Statement/v1';
    subject: Array<{
        name: string;
        digest: {
            sha256: string;
        };
    }>;
    predicateType: 'https://slsa.dev/provenance/v1';
    predicate: {
        buildDefinition: {
            buildType: string;
            externalParameters: JsonValue;
            internalParameters: JsonValue;
            resolvedDependencies: JsonValue[];
        };
        runDetails: {
            builder: {
                id: string;
            };
            metadata: {
                invocationId: string;
                startedOn: string;
                finishedOn: string;
            };
        };
    };
}
/** Creates a deterministic local-only CycloneDX document from the release package manifest. */
export declare function generateCycloneDxSbom(root: string, options?: {
    now?: Date;
    serial?: string;
}): CycloneDxDocument;
/** Uses a local Syft binary for full image inventory; no report or source is sent to a service. */
export declare function generateImageSbom(imageRef: string, options?: {
    executable?: string;
    signal?: AbortSignal;
}): Promise<CycloneDxDocument>;
export declare function attachSbomToRelease(posture: SecurityPostureStore, scope: {
    organizationId: string;
    projectId: string;
    environmentId?: string;
    releaseId: string;
}, sbom: CycloneDxDocument): ReleaseSecurityArtifact;
export declare function attachVulnerabilitySummary(posture: SecurityPostureStore, scope: {
    organizationId: string;
    projectId: string;
    environmentId?: string;
    releaseId: string;
}, findings: SecurityPostureFinding[]): ReleaseSecurityArtifact;
export declare function createReleaseProvenance(input: {
    artifactName: string;
    artifact?: string | Uint8Array;
    artifactSha256?: string;
    invocationId: string;
    startedAt: string;
    completedAt: string;
    externalParameters?: JsonValue;
    resolvedDependencies?: JsonValue[];
}): ReleaseProvenance;
export declare function attachProvenanceToRelease(posture: SecurityPostureStore, scope: {
    organizationId: string;
    projectId: string;
    environmentId?: string;
    releaseId: string;
}, provenance: ReleaseProvenance): ReleaseSecurityArtifact;
export declare function verifyArtifactSignature(input: {
    artifact: string | Uint8Array;
    expectedSha256: string;
    signature?: string;
    publicKey?: string;
}): {
    digestValid: boolean;
    signature: 'verified' | 'invalid' | 'not_configured';
};
