/**
 * Skill Lineage Manifest — anchor (sprint-586).
 *
 * Dual-anchor strategy:
 *   Primary   — Starknet batch anchor via deriveStepLeaf / proof-core primitives.
 *   Fallback  — DigiCert RFC 3161 TSA (eIDAS qualified).
 *
 * HONEST DEGRADATION NOTICE:
 *   TSA-only mode is DEGRADED — not equivalent to Starknet.
 *   DigiCert is a centralised CA, not post-quantum.
 *   Manifests anchored via TSA only receive grade = 'tsa_fallback'.
 *   See docs/skill-lineage-honest.md for the full honesty statement.
 *
 * RFC 3161 primer:
 *   POST http://timestamp.digicert.com
 *   Content-Type: application/timestamp-query
 *   Body: DER-encoded TimeStampReq { version=1, msgImprint, nonce, certReq=true }
 *
 * @module skill-manifest/anchor
 */
import type { SkillManifest } from "./types.js";
/**
 * Request a RFC 3161 timestamp token from DigiCert TSA.
 *
 * On success: returns the raw TimeStampResp as base64.
 * On network failure / timeout: returns a deterministic mock token and logs
 * a DEGRADED warning. Callers MUST set grade = 'tsa_fallback' in both cases.
 *
 * @param manifestHash - Hex SHA-256 or Poseidon hash of the manifest.
 * @param options.tsaUrl - Override TSA endpoint (default: DigiCert).
 * @param options.timeout_ms - Request timeout in ms (default: 5000).
 */
export declare function anchorWithTsa(manifestHash: string, options?: {
    tsaUrl?: string;
    timeout_ms?: number;
}): Promise<string>;
export interface TsaTokenInfo {
    timestamp: Date;
    authority: string;
    hashAlgorithm: string;
    /** True when this is a mock token (not a real RFC 3161 response). */
    isMock: boolean;
}
/**
 * Parse a TSA token (base64) to extract metadata.
 *
 * Supports both real RFC 3161 TimeStampResp tokens and the mock token format
 * produced by anchorWithTsa when DigiCert is unreachable.
 *
 * For real tokens: performs a best-effort parse of the GeneralizedTime field
 * embedded in the DER. This is a structural scan, not a full ASN.1 decoder.
 *
 * @throws {Error} If the token cannot be decoded or is malformed.
 */
export declare function parseTsaToken(tsaTokenBase64: string): TsaTokenInfo;
/**
 * Verify that the manifest's poseidonHash is covered by its TSA token.
 *
 * Verification logic:
 *   1. Manifest must have a tsaToken field.
 *   2. parseTsaToken must succeed (token is structurally valid).
 *   3. For mock tokens: verify the embedded hash matches poseidonHash.
 *   4. For real tokens: return true (full DER chain verification requires
 *      a CMS/PKCS#7 library — not included to avoid supply-chain deps).
 *      Callers requiring full chain verification MUST use openssl ts -verify.
 *
 * Returns false (not throws) on any verification failure — callers decide
 * whether to reject or downgrade the manifest grade.
 */
export declare function verifyTsaAnchor(manifest: SkillManifest): boolean;
/**
 * Anchor a manifest on Starknet via the Brain batch anchor system.
 *
 * Uses the proof/index.ts leafHash pattern: the manifest is serialised as a
 * canonical JSON record and its SHA-256 leaf hash is submitted to the anchor
 * queue. The returned tx hash is stored in manifest.starknetAnchorTx.
 *
 * Falls back gracefully to null when:
 *   - No Starknet RPC available (rpcUrl unset and STARKNET_RPC_URL env absent).
 *   - starknet peer dep is absent at runtime.
 *   - Network errors.
 *
 * In all fallback cases: callers should downgrade to grade = 'tsa_fallback'
 * and invoke anchorWithTsa instead.
 *
 * @param manifest  - Manifest to anchor (must have poseidonHash set).
 * @param rpcUrl    - Optional Starknet RPC URL override.
 * @returns txHash string on success, null on failure.
 */
export declare function anchorWithStarknet(manifest: SkillManifest, rpcUrl?: string): Promise<string | null>;
//# sourceMappingURL=anchor.d.ts.map