import { z } from "zod";
import { AihError } from "../errors.js";
/**
 * Local verification evidence (W7 design §A.4) — a SEPARATE record from the
 * committed Framework Card, machine-level, in DERIVED storage. Where the card is
 * committed and MUST carry no machine-local path (H3), this record is
 * repo-local, gitignored, rebuildable, and ABSOLUTE PATHS ARE ITS PURPOSE: it
 * captures the exact checkout / install root, OS + CLI/runtime versions,
 * timestamps, contamination attribution, and (Phase 1b) the serialized doctor
 * transcript. It is NEVER an authority store — the committed DECLARATION stays
 * the only authority (D7).
 *
 * O3: it lives at repo-local `.aih/binding/evidence/<treeDigest>.json` beside the
 * lock, sharing the card's `treeDigest` identity so card and evidence
 * cross-reference. The writer mirrors `writeBindingLockAtomic` (validate -> temp
 * `0o600` -> rename) but is BEST-EFFORT on the fs write like `writeScanCache`
 * (`scan-gate.ts:1517`) — a write failure never changes any verdict; the next run
 * simply rebuilds it.
 */
export declare const LOCAL_EVIDENCE_SCHEMA_VERSION: 1;
/** One contamination finding, with attribution (design §B.1 shape; abs paths allowed). */
export declare const EvidenceContaminationEntrySchema: z.ZodObject<{
    framework: z.ZodOptional<z.ZodString>;
    surface: z.ZodString;
    detail: z.ZodString;
}, z.core.$strict>;
export type EvidenceContaminationEntry = z.infer<typeof EvidenceContaminationEntrySchema>;
/**
 * The local verification evidence record. Unlike the card, string fields MAY be
 * absolute machine paths — no `assertNoMachineLocalPath` runs here. Phase-2
 * payload (network-monitor results, process inventory) is intentionally absent.
 */
export declare const LocalVerificationEvidenceSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<1>;
    treeDigest: z.ZodString;
    framework: z.ZodEnum<{
        ecc: "ecc";
        superpowers: "superpowers";
    }>;
    checkoutPath: z.ZodString;
    installRoot: z.ZodOptional<z.ZodString>;
    os: z.ZodObject<{
        platform: z.ZodString;
        release: z.ZodString;
        arch: z.ZodString;
    }, z.core.$strict>;
    runtime: z.ZodObject<{
        node: z.ZodString;
        bun: z.ZodOptional<z.ZodString>;
        claudeCode: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>;
    measuredAt: z.ZodString;
    contamination: z.ZodArray<z.ZodObject<{
        framework: z.ZodOptional<z.ZodString>;
        surface: z.ZodString;
        detail: z.ZodString;
    }, z.core.$strict>>;
    doctorTranscript: z.ZodArray<z.ZodUnknown>;
}, z.core.$strict>;
export type LocalVerificationEvidence = z.infer<typeof LocalVerificationEvidenceSchema>;
/** Corrupt / schema-invalid local evidence — fail closed, never guess. */
export declare class LocalVerificationEvidenceError extends AihError {
    constructor(message: string);
}
export declare function parseLocalVerificationEvidence(value: unknown): LocalVerificationEvidence;
/** `<root>/.aih/binding/evidence` — the derived, gitignored evidence dir (beside the lock). */
export declare function evidenceDir(root: string): string;
/** `<root>/.aih/binding/evidence/<treeDigest>.json` (O3). */
export declare function evidencePath(root: string, treeDigest: string): string;
/**
 * Atomically write the evidence record (validate -> temp file with owner-only
 * mode -> rename), keyed by the record's own `treeDigest`. VALIDATION fails
 * closed (a malformed record is a caller bug); the fs write is BEST-EFFORT
 * (mirrors `writeScanCache`) — the record is rebuildable, so a write failure is
 * swallowed rather than allowed to change any verdict.
 */
export declare function writeLocalVerificationEvidenceAtomic(root: string, evidence: LocalVerificationEvidence): void;
/**
 * Read a local evidence record by tree digest. Absent => `undefined`. A present
 * file that is unparseable / schema-invalid FAILS CLOSED with
 * {@link LocalVerificationEvidenceError} (mirrors `readBindingLock`).
 */
export declare function readLocalVerificationEvidence(root: string, treeDigest: string): LocalVerificationEvidence | undefined;