import type { Request, Response, NextFunction } from "express";
import type { ProofMeta, DetachedProof } from "@kya-os/contracts/proof";
import type { Receipt } from "@kya-os/contracts/registry";
import { type StructuredError } from "@kya-os/contracts/verifier";
import { type CryptoProvider } from "@kya-os/mcp-i-core";
/**
 * Verifier middleware for proof and receipt validation
 */
export interface VerifierConfig {
    /**
     * Enable receipt verification
     */
    receiptVerification?: boolean;
    /**
     * Enable delegation checking
     */
    delegationChecking?: boolean;
    /**
     * KTA base URL
     */
    ktaBaseUrl?: string;
    /**
     * Policy toggle for receipt checking
     */
    receiptPolicy?: "required" | "optional" | "disabled";
    /**
     * Allow mock data for testing
     */
    allowMockData?: boolean;
    /**
     * Optional CryptoProvider for signature verification
     * If provided, enables full JWS signature verification when DetachedProof is available
     */
    cryptoProvider?: CryptoProvider;
}
export interface LocalVerifierResult {
    success: boolean;
    headers?: Record<string, string>;
    error?: StructuredError;
}
export interface VerifierContext {
    proof: ProofMeta;
    receipt?: Receipt;
    delegationRef?: string;
    /**
     * Optional full DetachedProof with JWS for signature verification
     * If provided, enables full cryptographic signature verification
     */
    detachedProof?: DetachedProof;
}
/**
 * Core verifier implementation
 */
export declare class CoreVerifier {
    private config;
    private receiptVerifier;
    private delegationManager;
    private cryptoService?;
    constructor(config?: VerifierConfig);
    /**
     * Verify proof with optional receipt checking
     */
    verify(context: VerifierContext): Promise<LocalVerifierResult>;
    /**
     * Verify proof signature
     *
     * Note: Full signature verification requires DetachedProof with JWS.
     * If only ProofMeta is available, performs structure validation only.
     * To enable full verification, provide detachedProof in VerifierContext.
     */
    private verifySignature;
    /**
     * Fetch public key from DID document
     *
     * Note: This is a simplified implementation. Production code should use
     * a proper DID resolver that supports multiple DID methods (did:key, did:web, etc.)
     */
    private fetchPublicKeyFromDID;
    /**
     * Verify delegation status
     */
    private verifyDelegation;
    /**
     * Check if receipt verification should be performed
     */
    private shouldVerifyReceipt;
    /**
     * Generate trusted headers for successful verification
     */
    private generateHeaders;
}
/**
 * Cloudflare Worker verifier
 */
export declare function verifyWorker(request: Request, config?: VerifierConfig): Promise<LocalVerifierResult>;
/**
 * Express verifier middleware
 */
export declare function verifyExpress(config?: VerifierConfig): (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;