import { z } from "zod";
import type { TRUST_POLICY_VERSION } from "../trust/evidence.js";
/**
 * Signed accepted-with-conditions policy decisions (W4 maintainer ruling (e)).
 *
 * A decision NEVER changes a signed vet verdict: blocked evidence stays
 * blocked-by-default in the vendor lock, findings intact. What it records is
 * that a named owner reviewed the EXACT findings on the EXACT pinned
 * components and accepts installing them for ONE exact
 * framework/profile/host/adapter tuple. The effective-eligibility join
 * (`verify.ts` at runtime; `check-baseline-installable.ts` at the release
 * gate) admits a blocked component only when every bound field matches and no
 * unwaivable finding is present; everything else stays held. Evidence
 * surfaces (checks, ledger authorizations, Framework Cards) carry the raw vet
 * outcome AND the acceptance side by side — an admitted component is never
 * reported as "vet passed".
 *
 * No wildcards, by construction: a decision binds exact repository, exact
 * 40-char commit, exact whole-tree digest, exact component ids WITH exact
 * component tree digests, and exact accepted finding codes. Any mismatch —
 * source, digest, component, extra finding code, expired or unsigned record —
 * leaves the component held.
 */
export declare const ACCEPTANCE_POLICY_VERSION = 1;
/** Corrected active-profile policy. No shipped record currently claims this version. */
export declare const CORRECTED_ACCEPTANCE_POLICY_VERSION = 2;
/**
 * Codes no acceptance decision may waive, ever: behavioral / supply-chain
 * danger classes where "reviewed the bytes" is not a sufficient basis to run
 * them. Mirrors the trust lane's danger floor at the next tier up.
 */
export declare const UNWAIVABLE_FINDING_CODES: ReadonlySet<string>;
declare const AcceptanceDecisionSchema: z.ZodObject<{
    decisionId: z.ZodString;
    decision: z.ZodLiteral<"accepted-with-conditions">;
    owner: z.ZodString;
    policyVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>;
    trustPolicyVersion: z.ZodOptional<z.ZodNumber>;
    framework: z.ZodString;
    profile: z.ZodString;
    host: z.ZodString;
    adapter: z.ZodString;
    repository: z.ZodString;
    commitSha: z.ZodString;
    treeDigest: z.ZodString;
    residualRisk: z.ZodString;
    components: z.ZodArray<z.ZodObject<{
        evidenceComponentId: z.ZodString;
        treeSha256: z.ZodString;
        acceptedFindingCodes: z.ZodArray<z.ZodString>;
        acceptedOccurrenceFingerprints: z.ZodOptional<z.ZodArray<z.ZodString>>;
        analyzerVersions: z.ZodOptional<z.ZodArray<z.ZodString>>;
    }, z.core.$strict>>;
    expiresAt: z.ZodOptional<z.ZodString>;
    recordSha256: z.ZodString;
}, z.core.$strict>;
export type AcceptanceDecision = z.infer<typeof AcceptanceDecisionSchema>;
/**
 * Canonical self-digest: sha256 over the key-sorted JSON of the decision with
 * `recordSha256` emptied. Within this repo's trust model the committed,
 * maintainer-pushed artifact is the signature; the self-digest pins the
 * record's exact content so any edit unsigns it.
 */
export declare function acceptanceRecordSha256(decision: AcceptanceDecision): string;
/**
 * Shipped decisions, schema-validated AND self-digest-verified. Any invalid,
 * unsigned, or digest-mismatched decision is EXCLUDED — a malformed artifact
 * can only narrow eligibility, never widen it.
 */
export declare function readAcceptanceDecisions(): readonly AcceptanceDecision[];
export interface ComponentAcceptanceCandidate {
    framework: string;
    repository: string;
    commitSha: string;
    componentId: string;
    componentTreeSha256: string;
    findingCodes: readonly string[];
    /** Set by corrected callers so legacy code-only decisions cannot cross policy versions. */
    policyVersion?: number;
}
export interface ComponentAcceptanceMatch {
    decisionId: string;
    recordSha256: string;
    acceptedFindingCodes: string[];
}
/**
 * Exact-tuple component admission over the EVIDENCE-side fields (the ECC
 * adapter separately asserts profile/host/adapter/treeDigest against the
 * resolved source — two enforcement points, each where its data natively
 * lives). Returns undefined — the component stays held — on any mismatch,
 * any finding code outside the accepted set, any unwaivable code, or an
 * expired decision.
 */
export declare function matchComponentAcceptance(decisions: readonly AcceptanceDecision[], candidate: ComponentAcceptanceCandidate, now?: Date, tuple?: AcceptanceTuple): ComponentAcceptanceMatch | undefined;
export interface AcceptanceTuple {
    framework: string;
    profile: string;
    host: string;
    adapter: string;
}
export interface CorrectedComponentAcceptanceCandidate extends ComponentAcceptanceCandidate {
    profile: string;
    host: string;
    adapter: string;
    sourceTreeDigest: string;
    occurrenceFingerprints: readonly string[];
    analyzerVersions: readonly string[];
    policyVersion: typeof CORRECTED_ACCEPTANCE_POLICY_VERSION;
    trustPolicyVersion: typeof TRUST_POLICY_VERSION;
}
/**
 * Corrected active-profile acceptance. Legacy code-only decisions are
 * deliberately ineligible: a match requires the exact source/component trees,
 * profile tuple, policy version, analyzer versions, and occurrence fingerprints.
 */
export declare function matchCorrectedComponentAcceptance(decisions: readonly AcceptanceDecision[], candidate: CorrectedComponentAcceptanceCandidate, now?: Date): ComponentAcceptanceMatch | undefined;
/**
 * Resolve-side binding check for a live install composition: when a decision
 * for the tuple exists, its repository, commit, and whole-tree digest must
 * match the actual resolution EXACTLY before acceptance may enter the
 * evidence pipeline. Returns human-readable mismatch descriptions (empty =
 * bound). A caller that passes acceptance into a pipeline MUST refuse on any
 * mismatch — a tuple-mismatched decision never rides along silently.
 */
export declare function acceptanceResolutionMismatches(decision: AcceptanceDecision, resolution: {
    repository: string;
    commitSha: string;
    treeDigest: string;
}): string[];
/** The decision for one framework/profile/host/adapter tuple, if shipped. */
export declare function findAcceptanceDecision(decisions: readonly AcceptanceDecision[], tuple: AcceptanceTuple): AcceptanceDecision | undefined;
export {};