import { type DatabricksCertificationEvidence } from "./certification.js";
export interface DatabricksAppRecoveryEvidence {
    schemaVersion: number;
    target: string;
    preparedAt?: string;
    verifiedAt?: string;
    restartRecovery?: {
        mode?: "explicit-name-stop-start";
        deploymentIdChanged?: boolean;
        sourceCodePathPreserved?: boolean;
        session?: boolean;
        submission?: boolean;
        conversationOffset?: boolean;
        attachment?: boolean;
    };
    approvalRecovery?: {
        identityPreserved?: boolean;
        resumedAfterRestart?: boolean;
        completedAfterApproval?: boolean;
    };
    cascadeDeletion?: {
        sessions?: number;
        submissions?: number;
        conversationStreams?: number;
        attachments?: number;
    };
}
export interface DatabricksAppUserIsolationEvidence {
    schemaVersion: number;
    target: string;
    generatedAt?: string;
    principalsDistinct?: boolean;
    ownerCanList?: boolean;
    ownerCanRead?: boolean;
    otherCannotList?: boolean;
    otherDirectReadStatus?: number;
    secretsAbsentFromResponses?: boolean;
    principalIdentifiersRetained?: boolean;
    dynamicAgentIsolation?: boolean;
    dynamicOwnerCanRead?: boolean;
    dynamicOtherConversationStatus?: number;
    dynamicOtherSubmissionStatus?: number;
    dynamicOtherSessionStatus?: number;
    dynamicOtherAdmissionStatus?: number;
    runIdHash?: string;
    dynamicInstanceIdHash?: string;
}
export interface DatabricksDynamicAgentEvidence {
    schemaVersion: number;
    target: string;
    preparedAt?: string;
    verifiedAt?: string;
    hookRendering?: boolean;
    conditionalModelAndTools?: boolean;
    durableToolStep?: boolean;
    crashRecoveryAfterCheckpoint?: boolean;
    exactlyOneToolStep?: boolean;
    persistentStateAfterRestart?: boolean;
    immutableInitialDataAcrossNamedSessions?: boolean;
    resourceChangeNarration?: boolean;
    dataParts?: boolean;
    responseMetadata?: boolean;
    lifecycleHooks?: boolean;
    externalDatabricksJob?: boolean;
    stableExternalIdempotency?: boolean;
    approvalRecovery?: boolean;
    rejectedApprovalPreventedExecution?: boolean;
    modelCancellation?: boolean;
    governedToolCancellation?: boolean;
    cancellationCleanup?: boolean;
    dynamicManagedMcp?: boolean;
    boundedSubagent?: boolean;
    scopedSubagentTool?: boolean;
    selfDispatchActorTenantPreserved?: boolean;
    responsesApi?: boolean;
    previousResponseId?: boolean;
    responsesStreaming?: boolean;
    cleanup?: boolean;
    instanceIdHash?: string;
    checkpointHash?: string;
}
export interface ValidateDatabricksReleaseEvidenceOptions {
    evidence: DatabricksCertificationEvidence;
    expectedPackageVersion: string;
    expectedCommitSha: string;
    expectedPackageArtifactSha256: string;
    expectedAppArtifactSha256: string;
    expectedRelatedEvidenceSha256?: Readonly<Record<string, string>>;
    maxAgeMs?: number;
    now?: Date;
}
export interface DatabricksReleaseEvidenceValidation {
    valid: true;
    evidenceId: string;
    packageVersion: string;
    requiredChecks: readonly string[];
}
export interface ValidateDatabricksCrossTierEvidenceOptions {
    consumption: DatabricksCertificationEvidence;
    authoring: DatabricksCertificationEvidence;
    expectedPackageVersion?: string;
    expectedCommitSha?: string;
    expectedPackageArtifactSha256?: string;
    maxAgeMs?: number;
    now?: Date;
}
export interface DatabricksCrossTierEvidenceManifest {
    schemaVersion: 1;
    valid: true;
    generatedAt: string;
    packageVersion: string;
    commitSha: string;
    packageArtifactSha256: string;
    consumption: {
        evidenceId: string;
        generatedAt: string;
    };
    authoring: {
        evidenceId: string;
        generatedAt: string;
    };
}
export interface ValidateDatabricksRollingEvidenceOptions {
    consumption: readonly DatabricksCertificationEvidence[];
    crossTier: readonly DatabricksCrossTierEvidenceManifest[];
    requiredDays?: number;
    now?: Date;
}
export interface DatabricksRollingEvidenceReport {
    schemaVersion: 1;
    valid: true;
    generatedAt: string;
    windowStart: string;
    windowEnd: string;
    requiredDays: number;
    consumptionDates: string[];
    crossTierDates: string[];
    packageVersions: string[];
}
/**
 * Fail closed unless Tier R and Tier A exercised the same immutable package tarball and commit.
 */
export declare function validateDatabricksCrossTierEvidence(options: ValidateDatabricksCrossTierEvidenceOptions): DatabricksCrossTierEvidenceManifest;
/**
 * Require daily Tier R evidence plus at least two same-candidate Tier R/A proofs in the rolling
 * public-claim window. Every Tier R record must bind two-user App isolation.
 */
export declare function validateDatabricksRollingEvidence(options: ValidateDatabricksRollingEvidenceOptions): DatabricksRollingEvidenceReport;
/**
 * Fail closed unless retained Databricks evidence proves the exact release commit and artifacts.
 */
export declare function validateDatabricksReleaseEvidence(options: ValidateDatabricksReleaseEvidenceOptions): DatabricksReleaseEvidenceValidation;
/** Assert that App restart evidence proves durable state, approval recovery, and cascade cleanup. */
export declare function validateDatabricksAppRecoveryEvidence(evidence: DatabricksAppRecoveryEvidence): void;
/** Assert that retained App evidence proves distinct principals and cross-user denial. */
export declare function validateDatabricksAppUserIsolationEvidence(evidence: DatabricksAppUserIsolationEvidence): void;
/** Assert that Tier R exercised hook-authored agents across a real App restart. */
export declare function validateDatabricksDynamicAgentEvidence(evidence: DatabricksDynamicAgentEvidence): void;
//# sourceMappingURL=release-evidence.d.ts.map