/**
 * Tool Integrity Tracker.
 *
 * Tracks SHA-256 hashes of tool YAML content to detect modifications.
 * Used during hot-reload to decide whether re-validation is needed.
 */
export interface IntegrityRecord {
    hash: string;
    source: 'trusted' | 'untrusted';
    validatedAt: Date;
}
export type IntegrityAction = {
    action: 'keep';
    reason: 'unchanged';
} | {
    action: 'revalidate';
    reason: 'content-modified';
} | {
    action: 'revalidate';
    reason: 'source-changed';
} | {
    action: 'validate';
    reason: 'new-tool';
};
export declare class ToolIntegrityTracker {
    private readonly records;
    /**
     * Compute SHA-256 hash of content.
     */
    computeHash(content: string): string;
    /**
     * Called when a tool is loaded. Compares the content hash and source with the stored
     * record and returns what action the caller should take.
     * If the tool moved between trusted/untrusted paths, revalidate is required even if content unchanged.
     */
    onToolLoaded(toolName: string, yamlContent: string, source: 'trusted' | 'untrusted'): IntegrityAction;
    /**
     * Record a tool's hash after successful validation/loading.
     */
    record(toolName: string, yamlContent: string, source: 'trusted' | 'untrusted'): void;
    /**
     * Get the stored record for a tool.
     */
    getRecord(toolName: string): IntegrityRecord | undefined;
    /**
     * Get the stored hash for a tool.
     */
    getHash(toolName: string): string | undefined;
    /**
     * Remove a tool entry (e.g. when it's been removed from disk).
     */
    removeEntry(toolName: string): boolean;
    /**
     * Clear all records. Used when doing a full reset.
     */
    clear(): void;
    /**
     * Get the number of tracked tools.
     */
    get size(): number;
}
//# sourceMappingURL=integrity-tracker.d.ts.map