/**
 * Per-checkout nonce — the only evidence that proves a project MOVED
 * (T12470 · ADR-094).
 *
 * `.cleo/project-id` is committed, so a clone, a fork or a hostile copy of the
 * file declares a registered project's id. Git state is no better: a clone has
 * the same root commit and remote, a bare `git init` can add any remote, and a
 * root commit can be faked with `refs/replace`. What a clone can NOT have is
 * local, untracked state. This module keeps a random nonce in the checkout's
 * `.cleo/project-info.json` — never tracked (ADR-013 §9) — and the registry
 * records it on each confirmed location. A real `mv`, or a restore of `.cleo/`
 * from a backup, carries the nonce with it; a clone has none, or its own.
 *
 * @task T12470
 * @module nexus/checkout-nonce
 */
/** `project-info.json` field that carries the nonce. */
export declare const CHECKOUT_NONCE_FIELD = "checkoutNonce";
/**
 * Read the checkout's nonce.
 *
 * @param projectRoot - Checkout root (the directory containing `.cleo/`).
 * @returns The nonce, or `null` when the checkout has none.
 *
 * @example
 * ```ts
 * const nonce = readCheckoutNonce(root);
 * ```
 */
export declare function readCheckoutNonce(projectRoot: string): string | null;
/**
 * Return the checkout's nonce, minting one into `project-info.json` when the
 * file exists and has none. Called only when a location is CONFIRMED, so a
 * candidate never gains a nonce the registry would accept.
 *
 * Never creates `project-info.json`: a checkout without one (a fresh clone
 * before `cleo init`) has no nonce, and its moves are confirmed explicitly.
 *
 * @param projectRoot - Checkout root.
 * @returns The nonce, or `null` when there is no `project-info.json` to hold it.
 *
 * @example
 * ```ts
 * const nonce = ensureCheckoutNonce(root);
 * ```
 */
export declare function ensureCheckoutNonce(projectRoot: string): string | null;
//# sourceMappingURL=checkout-nonce.d.ts.map