import type { AtribRecord } from './types.js';
/**
 * Read the most recent record from a JSONL mirror file.
 *
 * @param opts.path Path to the mirror file. Returns null if the file does
 *   not exist (per §5.8 degradation).
 * @param opts.contextId Optional. When supplied, only the most recent record
 *   matching this context_id is returned. When omitted, the most recent
 *   record overall is returned (any context_id).
 * @returns The most recent matching record, or null if none found.
 */
export declare function readMirrorTail(opts: {
    path: string;
    contextId?: string | undefined;
}): Promise<AtribRecord | null>;
/**
 * Return true when a signed-record mirror contains the requested record_hash.
 *
 * This is a producer-side validation helper for Node hosts. It accepts both
 * bare-record and envelope mirror lines, skips malformed lines, and never
 * throws to the caller. The public log may lag local signing, so callers
 * should use this for mirror-backed refs, not for parent-env spawn anchors
 * that were just signed in the parent process.
 */
export declare function recordHashExistsInMirror(opts: {
    path: string;
    recordHash: string;
    contextId?: string | undefined;
}): Promise<boolean>;
export interface ChainContext {
    contextId: string;
    chainRoot: string;
    inheritedFrom: 'caller-supplied' | 'fresh-orphan' | 'env-tail' | 'mirror-tail' | 'fresh';
}
export type MirrorInheritanceScope = 'corpus' | 'file';
/**
 * Resolve `{contextId, chainRoot}` for a producer about to sign a record,
 * orchestrating context_id inheritance + chain_root resolution end to end.
 *
 * Decision tree:
 *
 *   1. Caller supplies BOTH `callerContextId` and `callerChainRoot`:
 *      use both verbatim. inheritedFrom = 'caller-supplied'.
 *
 *   2. Caller supplies `callerContextId` only:
 *      - If `ATRIB_CHAIN_TAIL_<callerContextId>` env var is set with a
 *        valid `sha256:<64-hex>` value: chain to it. inheritedFrom = 'env-tail'.
 *      - Else if a mirror tail on the same `callerContextId` exists:
 *        chain to it. inheritedFrom = 'mirror-tail'.
 *      - Else: genesis chain_root for `callerContextId`. inheritedFrom = 'fresh'.
 *
 *   3. Caller supplies no `callerContextId`:
 *      Synthesize a fresh random context_id + genesis chain_root. The result
 *      is marked 'fresh-orphan' to signal that the runtime did NOT pass a
 *      session identifier to the producer (typically a Layer-2 hook miswire
 *      or a harness that doesn't expose its session_id). The orphan record
 *      lands in its own isolated context rather than being absorbed into
 *      whichever session happens to be at the mirror tail. See [D072] for
 *      the rationale; the prior 'mirror-context-and-tail' behavior collapsed
 *      every orphan into one giant pseudo-session ('1500+ records spanning
 *      6+ days under one context_id' in production), which made orphan
 *      provenance unrecoverable.
 *
 *      Consumers can identify orphans by `inheritedFrom === 'fresh-orphan'`
 *      and surface them as such; recall/trace/summarize MAY filter them.
 *
 * Inheriting only `callerContextId` from the caller WHILE pulling chain_root
 * from a mirror that is on a DIFFERENT context_id is forbidden, it would
 * produce a malformed record. The filter-by-context_id behavior in
 * `readMirrorCorpusTail` enforces this across every local mirror file.
 */
export declare function inheritChainContext(opts: {
    callerContextId?: string | undefined;
    callerChainRoot?: string | undefined;
    mirrorPath?: string | undefined;
    /** Default `corpus`; explicit per-client mirrors can request file isolation. */
    mirrorScope?: MirrorInheritanceScope | undefined;
    env?: NodeJS.ProcessEnv;
    randomContextId: () => string;
}): Promise<ChainContext>;
//# sourceMappingURL=mirror.d.ts.map