/**
 * The `fjall drift repair` ceremony — the drift-flavoured twin of the deploy
 * destruction gate. Builds a `DestructionTicket` from CONFIRMED drift
 * findings (never unconfirmed — fail-closed verdicts refuse remediation) and
 * evaluates `--remediate` consents through the SAME engine primitives
 * (`evaluateDestructionConsents`, digest TOCTOU, [G6] verdict table,
 * `executableRemediationVerbs`) so the two ceremonies cannot drift apart.
 *
 * Deliberately no plan loader and no interactive resolver: repair consents
 * arrive as flags ([G5] — the agent surface teaches the flag SHAPE, the
 * operator types the physical name). All output lines are identifier-only
 * (physical names, verbs) — pre-masked by construction.
 */
import { type DriftFinding } from "../../types/drift.js";
import type { DestructionConsent, DestructionConsentReport, DestructionOutcome, DestructionTicket, RemediationVerb } from "../../types/destruction.js";
/**
 * Build the repair ticket from confirmed-deleted findings. Returns undefined
 * when nothing is confirmed (unconfirmed/stack-missing stay repair-only and
 * never ticket). `physicalName` is the probed live physical id ([G6] — the
 * exact string the operator must type); findings without one (membership
 * listing could not resolve an id) fall back to the
 * `remediationPlaceholderPhysicalId` address, same as the plan gate — the
 * shared builder is what keeps this [G6] address byte-agreed with the
 * journal target's physicalId, so the consent covers the target operated on.
 */
export declare function buildDriftRepairTicket(findings: readonly DriftFinding[]): DestructionTicket | undefined;
/**
 * [I1] The verbs a drift-DETECT surface may ADVERTISE for one finding — the
 * verdict vocabulary reduced to what this gate would let execute. The
 * drift-detect twin of `advertisableRemediationVerbs`: a confirmed-deleted
 * finding tickets as `resource-deleted` (see `buildDriftRepairTicket` above),
 * whose only execution arm is forget, so advertising recreate sells a consent
 * the execution check withholds (consent-not-executable). Non-ticketing
 * verdicts (unconfirmed, stack-missing, present) keep their vocabulary
 * unchanged — they never enter the consent ceremony, so there is no gate to
 * disagree with and `repair` stays the honest report-only teach.
 * Consumers: the CLI drift-detect agent block rows + confirmed-verbs help
 * line and the human `formatVerbList` line.
 */
export declare function advertisableDriftVerbs(finding: Pick<DriftFinding, "verdict" | "verbs">): RemediationVerb[];
export interface RunDriftRepairGateParams {
    ticket: DestructionTicket;
    consents: readonly DestructionConsent[];
    /** Digest the consents were minted against (agent two-step) — TOCTOU. */
    consentDigest?: string;
}
export type DriftRepairGateOutcome = 
/** Every resource consented with an executable verb — run the surgery. */
{
    kind: "proceed";
    /** The consented verb per exact physical name. */
    verbsByPhysicalName: ReadonlyMap<string, RemediationVerb>;
    report: DestructionConsentReport;
} | {
    kind: "withheld";
    outcome: DestructionOutcome;
    report: DestructionConsentReport;
    reasons: string[];
};
/**
 * Evaluate repair consents — the exact fail-closed semantics of the deploy
 * gate (matched/unmatched/wrong-verb rows, uncovered fails closed, digest
 * mismatch stales everything, abort verb = operator decline, non-executable
 * verb withholds truthfully).
 */
export declare function runDriftRepairGate(params: RunDriftRepairGateParams): DriftRepairGateOutcome;