@hasna/infinity 0.1.0

package/dist/types/brokers/checkpoint/verifier-cleanup.d.ts

@@ -0,0 +1,391 @@
+import { type BrokerFence } from "../../contracts/fence";
+import { type Int64 } from "../../core/int64";
+export type VerifierSandboxProvider = "e2b" | "daytona_cloud";
+export type VerifierSandboxDependentResourceType = "volume" | "network_attachment" | "snapshot";
+export interface ManagedVerifierProviderHandle {
+    schemaVersion: "sandboxes.provider-handle/v1";
+    provider: VerifierSandboxProvider;
+    providerAccountRef: string;
+    region: string;
+    resourceType: "sandbox";
+    nativeResourceId: string;
+    nativeIncarnationId: string;
+    clientTokenSha256: string;
+    creationReceiptSha256: string;
+    ownershipReceiptSha256: string;
+}
+export interface ManagedVerifierDependentResource {
+    schemaVersion: "sandboxes.dependent-resource/v1";
+    provider: VerifierSandboxProvider;
+    providerAccountRef: string;
+    region: string;
+    resourceType: VerifierSandboxDependentResourceType;
+    nativeResourceId: string;
+    nativeIncarnationId: string;
+    ownershipReceiptSha256: string;
+}
+export interface SandboxesVerifierAllocationReceiptCore {
+    schemaVersion: "sandboxes.verifier-allocation-receipt/v1";
+    issuer: string;
+    audience: "infinity:clean-verifier";
+    verificationFence: BrokerFence;
+    resourceId: string;
+    resourceLeaseId: string;
+    resourceLifecycleGeneration: Int64;
+    providerHandle: ManagedVerifierProviderHandle;
+    dependentResources: ManagedVerifierDependentResource[];
+    dependentResourceClosureSha256: string;
+    allocatedAt: string;
+    expiresAt: string;
+}
+export interface SandboxesVerifierAllocationReceiptAttestation {
+    schemaVersion: "sandboxes.verifier-allocation-attestation/v1";
+    keyId: string;
+    algorithm: "ecdsa-p256-sha256";
+    signedCoreSha256: string;
+    signatureBase64: string;
+    signatureSha256: string;
+    receiptSha256: string;
+}
+export interface SandboxesVerifierAllocationReceipt extends SandboxesVerifierAllocationReceiptCore {
+    attestation: SandboxesVerifierAllocationReceiptAttestation;
+}
+export interface SandboxesVerifierAllocationReceiptVerifierPort {
+    verifyDigest(input: {
+        domain: "sandboxes.verifier-allocation-receipt/v1";
+        issuer: string;
+        audience: "infinity:clean-verifier";
+        digest: string;
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }): Promise<boolean>;
+}
+export interface ManagedVerifierSandboxHandle {
+    resourceId: string;
+    resourceLeaseId: string;
+    resourceLifecycleGeneration: Int64;
+    leaseHolderPrincipal: string;
+    operationExecutorPrincipal: string;
+    audience: "clean-verifier";
+    providerHandle: ManagedVerifierProviderHandle;
+    dependentResources: ManagedVerifierDependentResource[];
+    dependentResourceClosureSha256: string;
+    allocationReceipt: SandboxesVerifierAllocationReceipt;
+}
+export interface VerifierCleanupTarget {
+    schemaVersion: "infinity.verifier-cleanup-target/v1";
+    resourceId: string;
+    resourceLeaseId: string;
+    resourceLifecycleGeneration: Int64;
+    providerHandle: ManagedVerifierProviderHandle;
+    dependentResources: ManagedVerifierDependentResource[];
+    dependentResourceClosureSha256: string;
+    allocationReceipt: SandboxesVerifierAllocationReceipt;
+    allocationReceiptSha256: string;
+}
+export interface VerifierCleanupGrantBinding {
+    checkpointSealSha256: string;
+    verificationDisposition: "pass" | "fail";
+    verificationResultSha256: string;
+}
+export interface VerifierCleanupGrantCore extends VerifierCleanupGrantBinding {
+    schemaVersion: "infinity.verifier-cleanup-grant/v2";
+    action: "destroy_verifier_sandbox";
+    maxUses: 1;
+    cleanupNonce: string;
+    consumptionTransactionId: string;
+    verificationOperationId: string;
+    verificationFence: BrokerFence;
+    fence: BrokerFence;
+    target: VerifierCleanupTarget;
+    targetSha256: string;
+    resourceGenerationBefore: Int64;
+    resourceGenerationAfter: Int64;
+    expiresAt: string;
+}
+export interface VerifierCleanupGrant extends VerifierCleanupGrantCore {
+    grantSha256: string;
+}
+export interface SandboxesResourceAbsence {
+    schemaVersion: "sandboxes.resource-absence/v1";
+    provider: VerifierSandboxProvider;
+    providerAccountRef: string;
+    region: string;
+    resourceType: "sandbox" | VerifierSandboxDependentResourceType;
+    nativeResourceId: string;
+    nativeIncarnationId: string;
+    absent: true;
+    providerRequestId: string;
+}
+export interface SandboxesVerifierCleanupReceiptCore extends VerifierCleanupGrantBinding {
+    schemaVersion: "sandboxes.verifier-cleanup-receipt/v1";
+    issuer: string;
+    audience: "infinity:verifier-cleanup";
+    action: "destroy_verifier_sandbox";
+    maxUses: 1;
+    cleanupNonce: string;
+    consumptionTransactionId: string;
+    verificationOperationId: string;
+    verificationFence: BrokerFence;
+    cleanupFence: BrokerFence;
+    cleanupGrant: VerifierCleanupGrant;
+    target: VerifierCleanupTarget;
+    targetSha256: string;
+    dependentResourceClosureSha256: string;
+    resourceGenerationBefore: Int64;
+    resourceGenerationAfter: Int64;
+    rootAbsence: SandboxesResourceAbsence;
+    dependentAbsences: SandboxesResourceAbsence[];
+    dependentAbsenceClosureSha256: string;
+    issuedAt: string;
+    completedAt: string;
+    expiresAt: string;
+}
+export interface SandboxesVerifierCleanupReceiptAttestation {
+    schemaVersion: "sandboxes.verifier-cleanup-attestation/v1";
+    keyId: string;
+    algorithm: "ecdsa-p256-sha256";
+    signedCoreSha256: string;
+    signatureBase64: string;
+    signatureSha256: string;
+    receiptSha256: string;
+}
+export interface SandboxesVerifierCleanupReceipt extends SandboxesVerifierCleanupReceiptCore {
+    attestation: SandboxesVerifierCleanupReceiptAttestation;
+}
+export type VerifierQuarantineReason = "invalid_allocation" | "cleanup_failure";
+export interface VerifierQuarantineExpectation {
+    verificationFence: BrokerFence;
+    quarantineReason: VerifierQuarantineReason;
+    quarantineSubjectSha256: string;
+}
+export interface SandboxesVerifierQuarantineReceiptCore {
+    schemaVersion: "sandboxes.verifier-quarantine-receipt/v1";
+    issuer: string;
+    audience: "infinity:verifier-quarantine";
+    quarantineReason: VerifierQuarantineReason;
+    verificationFence: BrokerFence;
+    resourceId: string;
+    resourceLeaseId: string;
+    resourceLifecycleGeneration: Int64;
+    quarantineSubjectSha256: string;
+    quarantined: true;
+    providerRequestId: string;
+    completedAt: string;
+    expiresAt: string;
+}
+export interface SandboxesVerifierQuarantineReceiptAttestation {
+    schemaVersion: "sandboxes.verifier-quarantine-attestation/v1";
+    keyId: string;
+    algorithm: "ecdsa-p256-sha256";
+    signedCoreSha256: string;
+    signatureBase64: string;
+    signatureSha256: string;
+    receiptSha256: string;
+}
+export interface SandboxesVerifierQuarantineReceipt extends SandboxesVerifierQuarantineReceiptCore {
+    attestation: SandboxesVerifierQuarantineReceiptAttestation;
+}
+export interface SandboxesVerifierQuarantineReceiptVerifierPort {
+    verifyDigest(input: {
+        domain: "sandboxes.verifier-quarantine-receipt/v1";
+        issuer: string;
+        audience: "infinity:verifier-quarantine";
+        digest: string;
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }): Promise<boolean>;
+}
+export interface SandboxesVerifierCleanupReceiptVerifierPort {
+    verifyDigest(input: {
+        domain: "sandboxes.verifier-cleanup-receipt/v1";
+        issuer: string;
+        audience: "infinity:verifier-cleanup";
+        digest: string;
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }): Promise<boolean>;
+}
+export interface VerifierCleanupCommitReceipt extends VerifierCleanupGrantBinding {
+    schemaVersion: "infinity.verifier-cleanup-consumption/v1";
+    action: "destroy_verifier_sandbox";
+    cleanupNonce: string;
+    consumptionTransactionId: string;
+    verificationOperationId: string;
+    verificationFence: BrokerFence;
+    cleanupFence: BrokerFence;
+    target: VerifierCleanupTarget;
+    targetSha256: string;
+    dependentResourceClosureSha256: string;
+    sandboxesCleanupReceiptSha256: string;
+    resourceGenerationBefore: Int64;
+    resourceGenerationAfter: Int64;
+    logicalCleanupState: "committed";
+    promotionGate: "open" | "closed";
+    authorityTransactionId: string;
+    authorityEventId: string;
+    committedAt: string;
+}
+export interface VerifiedVerifierCleanupEvidence {
+    sandboxReceipt: SandboxesVerifierCleanupReceipt;
+    consumptionCommit: VerifierCleanupCommitReceipt;
+}
+export interface VerifierCleanupAuthorityPort {
+    authorize(input: {
+        verificationFence: BrokerFence;
+        handle: ManagedVerifierSandboxHandle;
+        checkpointSealSha256: string;
+        verificationDisposition: "pass" | "fail";
+        verificationResultSha256: string;
+    }): Promise<VerifierCleanupGrant>;
+    consumeAndCommit(input: {
+        verificationFence: BrokerFence;
+        grant: VerifierCleanupGrant;
+        receipt: SandboxesVerifierCleanupReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+    }): Promise<VerifierCleanupCommitReceipt>;
+    verifyCommitted(input: {
+        consumptionTransactionId: string;
+        cleanupNonce: string;
+        grant: VerifierCleanupGrant;
+        receipt: SandboxesVerifierCleanupReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+        commit: VerifierCleanupCommitReceipt;
+    }): Promise<VerifierCleanupCommitReceipt>;
+    recordQuarantine(input: {
+        receipt: SandboxesVerifierQuarantineReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+    }): Promise<SandboxesVerifierQuarantineReceipt>;
+    verifyQuarantineRecorded(input: {
+        receipt: SandboxesVerifierQuarantineReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+    }): Promise<SandboxesVerifierQuarantineReceipt>;
+}
+export interface VerifierCleanupGrantAuthorityPort {
+    authorize(input: {
+        verificationFence: BrokerFence;
+        handle: ManagedVerifierSandboxHandle;
+        checkpointSealSha256: string;
+        verificationDisposition: "pass" | "fail";
+        verificationResultSha256: string;
+    }): Promise<VerifierCleanupGrant>;
+}
+export interface VerifierCleanupFenceAuthorityPort {
+    readCurrentFence(operationId: string): Promise<{
+        fence: BrokerFence;
+        databaseTime: Date;
+    }>;
+}
+export declare class InMemoryVerifierCleanupAuthority implements VerifierCleanupAuthorityPort {
+    private readonly dependencies;
+    private sequence;
+    private readonly issuedByGrant;
+    private readonly issuedGrantByTransaction;
+    private readonly issuedGrantByNonce;
+    private readonly byTransaction;
+    private readonly transactionByNonce;
+    private readonly transactionByGrant;
+    private readonly resourceGeneration;
+    private readonly quarantineReceipts;
+    private consumptionTail;
+    constructor(dependencies: {
+        grantAuthority: VerifierCleanupGrantAuthorityPort;
+        receiptVerifier: SandboxesVerifierCleanupReceiptVerifierPort;
+        allocationReceiptVerifier: SandboxesVerifierAllocationReceiptVerifierPort;
+        quarantineReceiptVerifier: SandboxesVerifierQuarantineReceiptVerifierPort;
+        fenceAuthority: VerifierCleanupFenceAuthorityPort;
+    });
+    authorize(input: Parameters<VerifierCleanupGrantAuthorityPort["authorize"]>[0]): Promise<VerifierCleanupGrant>;
+    consumeAndCommit(input: {
+        verificationFence: BrokerFence;
+        grant: VerifierCleanupGrant;
+        receipt: SandboxesVerifierCleanupReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+    }): Promise<VerifierCleanupCommitReceipt>;
+    verifyCommitted(input: {
+        consumptionTransactionId: string;
+        cleanupNonce: string;
+        grant: VerifierCleanupGrant;
+        receipt: SandboxesVerifierCleanupReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+        commit: VerifierCleanupCommitReceipt;
+    }): Promise<VerifierCleanupCommitReceipt>;
+    recordQuarantine(input: {
+        receipt: SandboxesVerifierQuarantineReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+    }): Promise<SandboxesVerifierQuarantineReceipt>;
+    verifyQuarantineRecorded(input: {
+        receipt: SandboxesVerifierQuarantineReceipt;
+        receiptCanonicalBytes: Uint8Array;
+        receiptSha256: string;
+    }): Promise<SandboxesVerifierQuarantineReceipt>;
+}
+export declare function parseSandboxesVerifierAllocationReceipt(value: unknown, verificationFenceInput: BrokerFence): SandboxesVerifierAllocationReceipt;
+export declare function sandboxesVerifierAllocationReceiptDigest(receipt: SandboxesVerifierAllocationReceipt): string;
+export declare function verifySandboxesVerifierAllocationReceipt(receiptInput: SandboxesVerifierAllocationReceipt, verifier: SandboxesVerifierAllocationReceiptVerifierPort): Promise<void>;
+export declare function parseManagedVerifierSandboxHandle(value: unknown, verificationFenceInput: BrokerFence): ManagedVerifierSandboxHandle;
+export declare function verifierCleanupTarget(handleInput: ManagedVerifierSandboxHandle): VerifierCleanupTarget;
+export declare function verifierCleanupGrantDigest(core: VerifierCleanupGrantCore): string;
+export declare function verifierCleanupGrantRequestDigest(input: {
+    verificationFence: BrokerFence;
+    handle: ManagedVerifierSandboxHandle;
+    checkpointSealSha256: string;
+    verificationDisposition: "pass" | "fail";
+    verificationResultSha256: string;
+}): string;
+export declare function verifierCleanupOperationDigest(core: VerifierCleanupGrantCore | VerifierCleanupGrant): string;
+export declare function parseVerifierCleanupGrant(value: unknown, handleInput: ManagedVerifierSandboxHandle, verificationFenceInput: BrokerFence, bindingInput: VerifierCleanupGrantBinding): VerifierCleanupGrant;
+export declare function parseSandboxesVerifierCleanupReceipt(value: unknown, handleInput: ManagedVerifierSandboxHandle, grantInput: VerifierCleanupGrant): SandboxesVerifierCleanupReceipt;
+export declare function sandboxesVerifierCleanupReceiptDigest(receipt: SandboxesVerifierCleanupReceipt): string;
+export declare function verifySandboxesVerifierCleanupReceipt(receiptInput: SandboxesVerifierCleanupReceipt, verifier: SandboxesVerifierCleanupReceiptVerifierPort): Promise<void>;
+export declare function verifierQuarantineSubjectDigest(input: {
+    quarantineReason: VerifierQuarantineReason;
+    verificationFence: BrokerFence;
+    target: VerifierCleanupTarget | null;
+    invalidAllocationEvidenceSha256: string | null;
+}): string;
+/**
+ * Produces a bounded digest of untrusted allocation identity fields without
+ * invoking accessors. This lets quarantine evidence name the malformed native
+ * resource even when the full handle cannot be parsed safely.
+ */
+export declare function verifierInvalidAllocationEvidenceDigest(untrustedHandle: unknown): string;
+export declare function parseSandboxesVerifierQuarantineReceipt(value: unknown, expectedInput: VerifierQuarantineExpectation): SandboxesVerifierQuarantineReceipt;
+export declare function sandboxesVerifierQuarantineReceiptDigest(receipt: SandboxesVerifierQuarantineReceipt): string;
+export declare function sandboxesVerifierQuarantineReceiptCanonicalBytes(receipt: SandboxesVerifierQuarantineReceipt): Uint8Array;
+export declare function verifySandboxesVerifierQuarantineReceipt(receiptInput: SandboxesVerifierQuarantineReceipt, verifier: SandboxesVerifierQuarantineReceiptVerifierPort): Promise<void>;
+export declare function verifyRecordAndReadbackVerifierQuarantine(input: {
+    receipt: SandboxesVerifierQuarantineReceipt;
+    expected: VerifierQuarantineExpectation;
+    receiptVerifier: SandboxesVerifierQuarantineReceiptVerifierPort;
+    authority: VerifierCleanupAuthorityPort;
+}): Promise<SandboxesVerifierQuarantineReceipt>;
+export declare function parseVerifierCleanupCommitReceipt(value: unknown, grantInput: VerifierCleanupGrant, receiptInput: SandboxesVerifierCleanupReceipt): VerifierCleanupCommitReceipt;
+export declare function verifierCleanupCommitReceiptDigest(receipt: VerifierCleanupCommitReceipt): string;
+export declare function verifyConsumeAndCommitVerifierCleanup(input: {
+    verificationFence: BrokerFence;
+    handle: ManagedVerifierSandboxHandle;
+    grant: VerifierCleanupGrant;
+    receipt: SandboxesVerifierCleanupReceipt;
+    receiptVerifier: SandboxesVerifierCleanupReceiptVerifierPort;
+    authority: VerifierCleanupAuthorityPort;
+}): Promise<VerifiedVerifierCleanupEvidence>;
+export declare function verifyCommittedVerifierCleanupEvidence(input: {
+    grant: VerifierCleanupGrant;
+    receipt: SandboxesVerifierCleanupReceipt;
+    commit: VerifierCleanupCommitReceipt;
+    receiptVerifier: SandboxesVerifierCleanupReceiptVerifierPort;
+    authority: VerifierCleanupAuthorityPort;
+}): Promise<VerifiedVerifierCleanupEvidence>;
+export declare function assertVerifiedVerifierCleanupEvidence(evidenceInput: VerifiedVerifierCleanupEvidence): VerifiedVerifierCleanupEvidence;
+export declare function sandboxesVerifierCleanupReceiptCanonicalBytes(receipt: SandboxesVerifierCleanupReceipt): Uint8Array;

package/dist/types/brokers/checkpoint/verifier.d.ts

@@ -0,0 +1,225 @@
+import { type Int64 } from "../../core/int64";
+import { type AuthenticatedFenceContext, type BrokerFence, type BrokerFenceInput } from "../../contracts/fence";
+import { type CheckpointManifestSigningTrustHead } from "./manifest-signature";
+import { type CheckpointSealReceipt } from "./service";
+import { type VerifiedVerifierCleanupEvidence } from "./verifier-cleanup";
+export interface CleanVerifierHandoffRequest {
+    checkpoint: CheckpointSealReceipt;
+    fence: BrokerFenceInput;
+    verifierImageSha256: string;
+    sourceSnapshotSha256: string;
+    testPlanSha256: string;
+    secretScanPolicySha256: string;
+    networkPolicySha256: string;
+}
+export interface CleanVerifierHandoff {
+    readonly schemaVersion: "infinity.clean-verifier-handoff/v1";
+    readonly checkpointId: string;
+    readonly checkpointSealSha256: string;
+    readonly checkpointSeal: CheckpointSealReceipt;
+    readonly checkpointManifestSha256: string;
+    readonly fence: BrokerFence;
+    readonly repositoryId: string;
+    readonly objectFormat: "sha1" | "sha256";
+    readonly expectedBaseOid: string;
+    readonly targetRef: string;
+    readonly candidateOid: string;
+    readonly candidateTreeOid: string;
+    readonly runSpecSha256: string;
+    readonly policySha256: string;
+    readonly checkpointScanReceiptSha256: string;
+    readonly packerImageSha256: string;
+    readonly dataClass: "public" | "internal_non_sensitive" | "sensitive_restricted";
+    readonly artifacts: CheckpointSealReceipt["manifest"]["artifacts"];
+    readonly manifestObject: CheckpointSealReceipt["manifestObject"];
+    readonly signatureObject: CheckpointSealReceipt["signatureObject"];
+    readonly provenanceReceiptObject: CheckpointSealReceipt["provenanceReceiptObject"];
+    readonly archiveIndexSha256: string;
+    readonly signatureKeyId: string;
+    readonly signatureAlgorithm: "ecdsa-p256-sha256";
+    readonly signatureSha256: string;
+    readonly signatureTrustAnchorSha256: string;
+    readonly signatureKeyHistorySha256: string;
+    readonly authorityCommit: CheckpointSealReceipt["authorityCommit"];
+    readonly verifierImageSha256: string;
+    readonly sourceSnapshotSha256: string;
+    readonly testPlanSha256: string;
+    readonly secretScanPolicySha256: string;
+    readonly networkPolicySha256: string;
+    readonly credentialMode: "none";
+    readonly networkMode: "deny_all";
+    readonly reuseProducerState: false;
+    readonly createdAt: string;
+}
+export interface PassingVerificationReceiptInput {
+    completedAt: string;
+    testReceiptSha256: string;
+    secretScanReceiptSha256: string;
+    verifierResultAttestationSha256: string;
+    verifierResultSha256: string;
+    cleanupEvidence: VerifiedVerifierCleanupEvidence;
+    resourceLimitsSha256: string;
+    testCommandsSha256: string;
+}
+export interface PassingVerificationReceiptCore {
+    readonly schemaVersion: "infinity.verification-receipt/v1";
+    readonly verdict: "pass";
+    readonly handoffSha256: string;
+    readonly checkpointId: string;
+    readonly checkpointSealSha256: string;
+    readonly checkpointManifestSha256: string;
+    readonly manifestSigningKeyId: string;
+    readonly fence: BrokerFence;
+    readonly repositoryId: string;
+    readonly objectFormat: "sha1" | "sha256";
+    readonly expectedBaseOid: string;
+    readonly targetRef: string;
+    readonly candidateOid: string;
+    readonly candidateTreeOid: string;
+    readonly runSpecSha256: string;
+    readonly policySha256: string;
+    readonly checkpointScanReceiptSha256: string;
+    readonly packerImageSha256: string;
+    readonly dataClass: "public" | "internal_non_sensitive" | "sensitive_restricted";
+    readonly verifierImageSha256: string;
+    readonly sourceSnapshotSha256: string;
+    readonly testPlanSha256: string;
+    readonly secretScanPolicySha256: string;
+    readonly networkPolicySha256: string;
+    readonly testReceiptSha256: string;
+    readonly secretScanReceiptSha256: string;
+    readonly verifierResultAttestationSha256: string;
+    readonly verifierResultSha256: string;
+    readonly cleanupGrantSha256: string;
+    readonly sandboxesCleanupReceiptSha256: string;
+    readonly cleanupConsumptionCommitSha256: string;
+    readonly cleanupConsumptionTransactionId: string;
+    readonly cleanupDependentClosureSha256: string;
+    readonly cleanupResourceGenerationAfter: Int64;
+    readonly verifierAllocationReceiptSha256: string;
+    readonly verifierProviderHandleSha256: string;
+    readonly verifierNativeIncarnationId: string;
+    readonly verifierProviderNativeResourceId: string;
+    readonly resourceLimitsSha256: string;
+    readonly testCommandsSha256: string;
+    readonly startedAt: string;
+    readonly completedAt: string;
+}
+export interface VerificationReceiptAuthorityAttestation {
+    readonly schemaVersion: "infinity.verification-authority-attestation/v1";
+    readonly signingKeyId: string;
+    readonly signatureAlgorithm: "ecdsa-p256-sha256";
+    readonly signedCoreSha256: string;
+    readonly signatureBase64: string;
+    readonly signatureSha256: string;
+}
+export interface AuthoritySignedPassingVerificationReceipt extends PassingVerificationReceiptCore {
+    readonly authorityAttestation: VerificationReceiptAuthorityAttestation;
+}
+export interface VerificationReceiptFinalTrustAuthorization {
+    readonly schemaVersion: "infinity.verification-final-trust-authorization/v1";
+    readonly signedReceiptSha256: string;
+    readonly manifestSigningKeyId: string;
+    readonly signingTrustHead: CheckpointManifestSigningTrustHead;
+    readonly signingTrustHeadSha256: string;
+    readonly authorizedAt: string;
+    readonly signingKeyId: string;
+    readonly signatureAlgorithm: "ecdsa-p256-sha256";
+    readonly signedAuthorizationSha256: string;
+    readonly signatureBase64: string;
+    readonly signatureSha256: string;
+}
+export interface PassingVerificationReceipt extends AuthoritySignedPassingVerificationReceipt {
+    readonly finalTrustAuthorization: VerificationReceiptFinalTrustAuthorization;
+}
+export interface VerificationReceiptFinalTrustAuthorityPort {
+    /** Atomically locks durable current trust, compares expectedCurrentSigningTrustHead, and signs the authorization. */
+    authorizePassingReceipt(input: {
+        signedReceipt: AuthoritySignedPassingVerificationReceipt;
+        signedReceiptSha256: string;
+        manifestSigningKeyId: string;
+        expectedCurrentSigningTrustHead: CheckpointManifestSigningTrustHead;
+    }): Promise<VerificationReceiptFinalTrustAuthorization>;
+    /** Verifies the authorization signature and checks it against durable current trust at call time. */
+    verifyCurrentAuthorization(input: {
+        signedReceipt: AuthoritySignedPassingVerificationReceipt;
+        signedReceiptSha256: string;
+        manifestSigningKeyId: string;
+        authorization: VerificationReceiptFinalTrustAuthorization;
+    }): Promise<{
+        verified: boolean;
+        databaseTime: Date;
+        currentSigningTrustHead: CheckpointManifestSigningTrustHead;
+    }>;
+    /** Holds the durable current-trust lock until effect settles and supplies the exact locked head/time. */
+    withCurrentAuthorization<T>(input: {
+        receipt: PassingVerificationReceipt;
+        action: string;
+        promotionFence: BrokerFence;
+    }, effect: (context: VerificationReceiptCurrentTrustEffectContext) => Promise<T>): Promise<T>;
+}
+export interface VerificationReceiptFinalTrustCryptographyPort {
+    signDigest(input: {
+        domain: "infinity.verification-final-trust-authorization/v1";
+        digest: string;
+    }): Promise<{
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }>;
+    verifyDigest(input: {
+        domain: "infinity.verification-final-trust-authorization/v1";
+        digest: string;
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }): Promise<boolean>;
+}
+export interface VerificationReceiptCurrentTrustEffectContext {
+    currentSigningTrustHead: CheckpointManifestSigningTrustHead;
+    databaseTime: Date;
+    /** Rechecks trusted time under the same durable current-trust row lock. */
+    assertFreshAtDispatch(): Promise<{
+        currentSigningTrustHead: CheckpointManifestSigningTrustHead;
+        databaseTime: Date;
+    }>;
+}
+export interface VerificationReceiptCryptographyPort {
+    signDigest(input: {
+        domain: "infinity.verification-receipt/v1";
+        digest: string;
+        fence: BrokerFence;
+    }): Promise<{
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }>;
+    verifyDigest(input: {
+        domain: "infinity.verification-receipt/v1";
+        digest: string;
+        keyId: string;
+        algorithm: "ecdsa-p256-sha256";
+        signature: Uint8Array;
+    }): Promise<boolean>;
+}
+export declare function cleanVerifierOperationDigest(request: CleanVerifierHandoffRequest): string;
+export declare function createCleanVerifierHandoff(request: CleanVerifierHandoffRequest, currentFence: BrokerFence, authenticated: AuthenticatedFenceContext): CleanVerifierHandoff;
+/**
+ * Takes ownership of a handoff as plain data before any asynchronous boundary.
+ * The returned graph cannot retain aliases to caller-owned mutable objects.
+ */
+export declare function parseCleanVerifierHandoff(value: unknown): CleanVerifierHandoff;
+export declare function createPassingVerificationReceipt(handoff: CleanVerifierHandoff, input: PassingVerificationReceiptInput): PassingVerificationReceiptCore;
+export declare function signPassingVerificationReceipt(core: PassingVerificationReceiptCore, cryptography: VerificationReceiptCryptographyPort): Promise<AuthoritySignedPassingVerificationReceipt>;
+export declare function finalizePassingVerificationReceipt(signedReceipt: AuthoritySignedPassingVerificationReceipt, expectedCurrentSigningTrustHead: CheckpointManifestSigningTrustHead, authority: VerificationReceiptFinalTrustAuthorityPort): Promise<PassingVerificationReceipt>;
+export declare function verifyPassingVerificationReceiptSignature(receipt: PassingVerificationReceipt, cryptography: VerificationReceiptCryptographyPort): Promise<void>;
+export declare function verifyAuthoritySignedPassingVerificationReceiptSignature(receipt: AuthoritySignedPassingVerificationReceipt, cryptography: VerificationReceiptCryptographyPort): Promise<void>;
+export declare function verifyPassingVerificationReceiptFinalTrustAuthorization(receipt: PassingVerificationReceipt, authority: VerificationReceiptFinalTrustAuthorityPort): Promise<void>;
+export declare function verificationReceiptTrustGenerationDigest(receipt: PassingVerificationReceipt, context: VerificationReceiptCurrentTrustEffectContext): string;
+export declare function verificationReceiptDigest(receipt: PassingVerificationReceipt): string;
+export declare function validatePassingVerificationReceipt(receipt: PassingVerificationReceipt): void;
+export declare function validateAuthoritySignedPassingVerificationReceipt(receipt: AuthoritySignedPassingVerificationReceipt): void;
+export declare function parseVerificationReceiptFinalTrustAuthorization(value: unknown, signedReceipt: AuthoritySignedPassingVerificationReceipt): VerificationReceiptFinalTrustAuthorization;
+export declare function verificationReceiptFinalTrustAuthorizationDigest(input: Pick<VerificationReceiptFinalTrustAuthorization, "schemaVersion" | "signedReceiptSha256" | "manifestSigningKeyId" | "signingTrustHead" | "signingTrustHeadSha256" | "authorizedAt">): string;
+export declare function validateCheckpointSealReceipt(checkpoint: CheckpointSealReceipt): void;
+export declare function parseCheckpointSealReceipt(value: unknown): CheckpointSealReceipt;