import type { AgentDiscoveryBinding, DiscoverySource } from "./agent-discovery.js";
import { type snapshot } from "./codex-hook-trust-files.js";
import { type ReviewedNativeHookAdditions } from "./codex-hook-additions-review.js";
type Snapshot = ReturnType<typeof snapshot>;
/** A receipt projection, not an override supplied by a CLI caller. Only this
 * module can create the in-memory proof used by discovery verification. */
export interface CodexHookDiscoveryRecovery {
    readonly configPath: string;
    readonly beforeSha256: string;
    readonly currentSha256: string;
    readonly discoverySha256: string;
    readonly typedProjectionSha256: string;
}
/** Called after a complete journal/intent or the current reviewed native
 * transaction and exact intended trust writes have been checked. Recheck those
 * writes here so a raw hash alone can never
 * grant this exception. Policy bytes and recorded sources remain unchanged. */
export declare function createCodexHookDiscoveryRecovery(binding: AgentDiscoveryBinding, before: Snapshot, current: Snapshot, hooks: Array<{
    key: string;
    currentHash: string;
}>, additions?: ReviewedNativeHookAdditions): CodexHookDiscoveryRecovery | undefined;
export declare function assertCodexHookDiscoveryRecovery(binding: AgentDiscoveryBinding, witness: CodexHookDiscoveryRecovery): void;
/** Verify this one historical byte witness using the already-validated native
 * transition. Every other source still uses its ordinary current-file hash. */
export declare function verifiesCodexHookDiscoverySource(binding: AgentDiscoveryBinding, source: DiscoverySource, currentDigest: string | null, witness?: CodexHookDiscoveryRecovery): boolean;
export {};