/**
 * ID842 step 1 — host-independent execution-time fingerprint recheck (pure).
 *
 * Recomputes the CURRENT artifacts' bundle fingerprint with the CANONICAL algorithm
 * (server change-set.computeBundleFingerprint / crbundle.v1) and compares it to the
 * fingerprint authorized on the receipt/envelope. No network, no host callback —
 * measures only the artifacts it is given.
 *
 * Gated at the guard wire by GuardConfig.requireExecutionStateMatch
 * (guard@8 default true — fail-closed; false / 'warn' are explicit opt-down).
 */
import type { Artifact } from './types.js';
/** Context slots the server folds into crbundle.v1 (change-set.js:477–480). */
export type BundleFingerprintContext = {
    operation?: unknown;
    environment?: unknown;
    repository?: unknown;
    branch?: unknown;
    pull_request?: unknown;
    policy_profile?: unknown;
};
/**
 * Canonical crbundle.v1 bundle fingerprint — byte-identical to
 * coderifts-app change-set.computeBundleFingerprint(artifacts, context) at change-set.js:466.
 * Do NOT invent a second preimage.
 */
export declare function computeCanonicalBundleFingerprint(artifacts: Artifact[], context?: BundleFingerprintContext | null): string;
/** Stable reason codes (greppable; align with app verdict-core/execution-time-fingerprint). */
export declare const EXECUTION_TIME_FP_REASONS: Readonly<{
    readonly MATCH: "match";
    /** Current artifacts hash ≠ authorized fingerprint (T1→T2 content drift). */
    readonly FINGERPRINT_STALE_AT_EXECUTE: "fingerprint_stale_at_execute";
    /** Integrity-style alias used on the guard blocked path (IntegrityCause). */
    readonly EXECUTION_STATE_DRIFT: "EXECUTION_STATE_DRIFT";
    readonly MISSING_AUTHORIZED_FINGERPRINT: "missing_authorized_fingerprint";
    readonly MISSING_ARTIFACTS: "missing_artifacts";
}>;
export type ExecutionTimeFpReason = (typeof EXECUTION_TIME_FP_REASONS)[keyof typeof EXECUTION_TIME_FP_REASONS];
/**
 * Warn-mode classification: unmeasurable ≠ drift.
 * - fingerprint_stale_at_execute → real drift (loud: execution_state_drift_observed)
 * - missing_artifacts / missing_authorized_fingerprint → nothing to measure (quiet: execution_state_unmeasurable)
 */
export declare function isUnmeasurableExecutionStateReason(reason: string): boolean;
/** Fixed note on the quiet warn event — not evidence of drift, not evidence of safety. */
export declare const EXECUTION_STATE_UNMEASURABLE_NOTE = "nothing to measure \u2014 not evidence of drift, not evidence of safety";
export type ExecutionTimeFingerprintVerdict = {
    match: boolean;
    reason: ExecutionTimeFpReason;
    current_fingerprint: string | null;
    authorized_fingerprint: string | null;
};
/**
 * Extract the authorized fingerprint from a decision envelope / receipt view.
 * Authorize path: fingerprint === input_fingerprint === crbundle.v1 hash.
 */
export declare function authorizedFingerprintFromEnvelope(envelope: Record<string, unknown> | null | undefined): string | null;
export type CheckExecutionTimeFingerprintArgs = {
    /** CURRENT artifacts about to execute (host-independent: measured as given). */
    artifacts: Artifact[] | undefined | null;
    /** Same context slots the server folded into crbundle.v1 at authorize. */
    context?: BundleFingerprintContext | null;
    /** Explicit authorized fp (wins over envelope extraction). */
    authorizedFingerprint?: string | null;
    /** Decision envelope / receipt projection carrying the authorized fp. */
    envelope?: Record<string, unknown> | null;
};
/**
 * Pure execution-time check: recompute current artifacts fp and compare to authorized.
 * No network, no host-supplied expected_fingerprint trusted for the CURRENT measurement.
 */
export declare function checkExecutionTimeFingerprint(args?: CheckExecutionTimeFingerprintArgs): ExecutionTimeFingerprintVerdict;
//# sourceMappingURL=execution-time-fingerprint.d.ts.map