import { type CodexPluginSkillControl } from "./codex-plugin-skill-controls.js";
export declare const CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA: "hasna.codex-semantic-cache-witness.v1";
export interface CodexSemanticCacheControl {
    pluginId: string;
    namespace: string;
    pluginParent: string;
    remotePluginId?: string;
    receiptSha256?: string;
    manifestSha256: string;
    appSha256?: string;
    mcpSha256?: string;
}
export interface CodexSemanticCacheSkill {
    name: string;
    pluginId: string;
    namespace: string;
    pluginParent: string;
    disabledRules: string[];
}
/** Caller explicitly classifies a remote plugin parent whose only reviewed
 * capability is its app integration and whose cache contains no Skill docs. */
export interface CodexSemanticCacheAppOnlyParent {
    role: "app-only";
    pluginId: string;
    namespace: string;
    pluginParent: string;
    remotePluginId: string;
}
export interface CodexSemanticCacheAppOnlyParentWitness extends CodexSemanticCacheAppOnlyParent {
    receiptSha256: string;
    manifestSha256: string;
    appSha256: string;
    mcpSha256?: string;
}
/** Explicitly reviewed native MCP-hook parent. Its cache materializations are
 * admitted only when the complete manifest and hooks declaration were already
 * enrolled as full-byte native discovery sources. */
export interface CodexSemanticCacheReviewedHookParent {
    role: "reviewed-hook";
    pluginId: string;
    namespace: string;
    pluginParent: string;
    installation: "remote-receipt" | "local-marketplace";
    remotePluginId?: string;
    marketplaceSourcePath?: string;
    marketplaceSha256?: string;
}
export interface CodexSemanticCacheReviewedHookParentWitness extends CodexSemanticCacheReviewedHookParent {
    manifestSha256: string;
    hooksSha256: string;
    receiptSha256?: string;
}
export interface CodexSemanticCacheWitness {
    schema: typeof CODEX_SEMANTIC_CACHE_WITNESS_SCHEMA;
    cacheRoot: string;
    controls: CodexSemanticCacheControl[];
    appOnlyParents: CodexSemanticCacheAppOnlyParentWitness[];
    /** Optional only for compatibility with already persisted v1 witnesses. */
    hookParents?: CodexSemanticCacheReviewedHookParentWitness[];
    skills: CodexSemanticCacheSkill[];
    sha256: string;
}
export interface CaptureCodexSemanticCacheWitnessOptions {
    cacheRoot: string;
    controls: CodexPluginSkillControl[];
    /** Explicit package-reviewed parents; absence never infers this role. */
    appOnlyParents?: CodexSemanticCacheAppOnlyParent[];
    /** Explicit roles only; cache presence never creates a hook role. */
    reviewedHookParents?: CodexSemanticCacheReviewedHookParent[];
    rules: unknown;
    /** Package-owned, bounded read used by the existing semantic control review. */
    read?: (path: string) => string;
}
export declare function codexLocalMarketplaceMapsPlugin(text: string, marketplace: string, plugin: string): boolean;
/** Capture the current semantic identity without changing the stored baseline.
 * Existing package-owned parsers validate documents and capability controls. */
export declare function captureCodexSemanticCacheWitness(options: CaptureCodexSemanticCacheWitnessOptions): CodexSemanticCacheWitness;
/** Verify without mutating or replacing the saved witness. Version refreshes
 * pass only when their complete semantic projection and qualified names match. */
export declare function assertCodexSemanticCacheWitnessUnchanged(previous: CodexSemanticCacheWitness, current: CodexSemanticCacheWitness): void;