import { ABSENT_IDENTITY } from "./json-publisher";
export declare const PROVENANCE_VERSION = 1;
export declare const INTENT_VERSION = 1;
export interface ProvenanceLedger {
    readonly version: number;
    /** `agents.providers` keys GJC created, mapped to the value hash it wrote. */
    readonly providerKeys: Record<string, string>;
    /** Orchestration role keys GJC actually seeded, mapped to the value it wrote. */
    readonly seededOrchestrationKeys: Record<string, string>;
    /** Bridge directory path GJC created, when it created it. */
    readonly bridgePath?: string;
    /** Bridge entries GJC created, so the inverse removes exactly those. */
    readonly bridgeEntries?: readonly string[];
    /** True when GJC created the bridge directory itself (as opposed to populating an existing one). */
    readonly bridgeDirCreated?: boolean;
}
export declare const EMPTY_LEDGER: ProvenanceLedger;
export declare function readProvenance(provenancePath: string): Promise<ProvenanceLedger>;
export declare function writeProvenance(provenancePath: string, ledger: ProvenanceLedger): Promise<void>;
/**
 * True only when GJC recorded this provider key AND the value still hashes to
 * what GJC wrote. A user edit after install makes this false, which is what
 * keeps `--remove` from destroying their change.
 */
export declare function isProvenancedProvider(ledger: ProvenanceLedger, key: string, currentValueHash: string): boolean;
export declare function isProvenancedOrchestrationKey(ledger: ProvenanceLedger, key: string, currentValue: string): boolean;
/** Every `gjc`/`gjc-<preset>` key GJC recorded, so a plain `--remove` cleans up earlier `--mpreset` runs. */
export declare function provenancedProviderKeys(ledger: ProvenanceLedger): readonly string[];
export type IntentStep = "provider-config" | "orchestration-preferences";
/**
 * Durable, credential-free intent record.
 *
 * Written before either the target publish or the ledger commit, and carrying
 * BOTH identities for BOTH files, so recovery can classify each file as
 * before / intended-after / divergent from this record alone. It stores only
 * paths, key names, and hashes -- never file contents, diffs, or values -- so
 * it stays credential-free even though `config.json` holds a bcrypt password.
 */
export interface IntentRecord {
    readonly version: number;
    readonly step: IntentStep;
    readonly targetPath: string;
    readonly ownedKeys: readonly string[];
    readonly targetPreflightIdentity: string;
    readonly targetExpectedIdentity: string;
    readonly provenancePath: string;
    readonly provenancePreflightIdentity: string;
    readonly provenanceExpectedIdentity: string;
    /**
     * The exact ledger this step intended to commit.
     *
     * Carried so recovery can finish the commit without re-running the step. That
     * matters for seed-if-empty work: once the target publish has landed the roles
     * are no longer empty, so a retry would skip the step and the ledger would
     * never be written. Contains only key names and hashes, never values from the
     * user's files, so the record stays credential-free.
     */
    readonly provenancePayload?: ProvenanceLedger;
    readonly startedAt: string;
}
export declare function writeIntent(intentPath: string, intent: IntentRecord): Promise<void>;
export declare function readIntent(intentPath: string): Promise<IntentRecord | undefined>;
export declare function clearIntent(intentPath: string): Promise<void>;
/** Rebuild the ledger an interrupted step intended to commit, when it recorded one. */
export declare function pendingLedgerOf(intent: IntentRecord): ProvenanceLedger | undefined;
/** Where a file sits relative to an interrupted step. */
export type IntentFileState = "before" | "intended-after" | "divergent";
export declare function classifyIdentity(observed: string, preflight: string, expected: string): IntentFileState;
export type IntentRecovery = {
    readonly action: "discard";
    readonly detail: string;
} | {
    readonly action: "complete-ledger";
    readonly detail: string;
} | {
    readonly action: "refuse";
    readonly detail: string;
};
/**
 * Classify BOTH the target and the ledger before deciding what to do.
 *
 * Deliberately exhaustive over the nine combinations: a divergent ledger always
 * refuses, because replaying a recorded ledger output over a third party's
 * change would destroy it.
 */
export declare function classifyIntent(intent: IntentRecord): Promise<IntentRecovery>;
export { ABSENT_IDENTITY };