/**
 * Config G4 — read/write provenance.lock.json for CLI compile.
 */
import type { IR, IRProvenance } from '@angriff36/manifest/ir';
import { type ProvenanceLockfile, type ResolvedProvenanceConfig } from '@angriff36/manifest/config';
export declare function readProvenanceLockfile(cwd: string, relativePath: string): Promise<ProvenanceLockfile | null>;
export declare function writeProvenanceLockfile(cwd: string, relativePath: string, provenance: IRProvenance): Promise<string>;
/**
 * Fail closed when failIfStale + lockfile + deterministic drift.
 * Returns an error message or null when OK / not applicable.
 */
export declare function evaluateProvenanceStale(cwd: string, policy: ResolvedProvenanceConfig, provenance: IRProvenance): Promise<string | null>;
/**
 * Idempotent provenance: if an existing output IR was produced from the SAME
 * source (identical contentHash), reuse its compiledAt and recompute irHash.
 * Bypassed when deterministic provenance is enabled (fixed compiledAt required).
 */
export declare function stabilizeProvenance(ir: IR, outputPath: string, computeIRHash: (ir: IR) => Promise<string>, deterministicProvenance: boolean): Promise<void>;
/** Config G4 — failIfStale check + optional lockfile write after a successful compile. */
export declare function finalizeProvenanceLock(ir: IR | null | undefined, opts?: {
    dryRun?: boolean;
    cwd?: string;
}): Promise<void>;
//# sourceMappingURL=provenance-lockfile.d.ts.map