/** What an audit concluded, as the gate reads it. */
export interface Verdict {
    /** The archive reviewed, as the auditor referred to it. */
    bundle?: string | undefined;
    /** sha256 of the archive file — what pins the verdict to the bytes. */
    sha256?: string | undefined;
    /** The archive it was reviewed against, when the review was a diff. */
    baseline?: string | undefined;
    baselineSha256?: string | undefined;
    /** Which question was answered: whether to sign it, or whether to run it. */
    mode?: 'sign' | 'run' | undefined;
    state?: string | undefined;
    members?: number | undefined;
    /** How many members were actually read — the changed set, in diff mode. */
    reviewed?: number | undefined;
    verdict?: 'pass' | 'fail' | undefined;
    summary?: string | undefined;
    findings?: Finding[] | undefined;
    /** 'human' when a person recorded it rather than the skill. */
    by?: string | undefined;
    at?: string | undefined;
}
export interface Finding {
    severity: string;
    file: string;
    line?: number | undefined;
    what: string;
    why?: string | undefined;
}
export interface AuditOptions {
    /** The archive under review. */
    bundle: string;
    /** Where the verdict is written and read (default: `<bundle>.audit.json`). */
    verdict?: string | undefined;
    /** A previously approved archive to review against, when there is one. */
    baseline?: string | undefined;
}
/** What `prepare()` found, for a caller that wants to report it itself. */
export interface Preparation {
    bundle: string;
    sha256: string;
    state: string;
    members: string[];
    verdict: string;
    /**
     * What precedes the archive, when anything does: it runs, so it is part
     * of the review. A `#!` launcher is text, shown in full; anything else
     * (a SEA's runtime) is described.
     */
    prefix?: Prefix | undefined;
    /** Present when a baseline was supplied and exists. */
    baseline?: {
        path: string;
        sha256: string;
        added: string[];
        removed: string[];
        carried: number;
        /** Whether the prefix is byte for byte the baseline's. */
        samePrefix: boolean;
    } | undefined;
}
/** The bytes in front of an archive. */
export interface Prefix {
    bytes: number;
    sha256: string;
    /** For a `#!` launcher, its text. */
    script?: string | undefined;
}
/** What precedes the archive in `path`, if anything. */
export declare function prefixOf(path: string): Prefix | undefined;
/** Where the verdict for `bundle` lives, unless the caller says otherwise. */
export declare function verdictPath(bundle: string, override?: string | undefined): string;
/**
 * Describe what is about to be audited: its hash, its members, and — when a
 * baseline is given — what changed since. Throws when the archive does not hold
 * together, because reviewing an archive whose contents are not what it says
 * they are is worse than not reviewing it.
 */
export declare function prepare({ bundle, verdict, baseline }: AuditOptions): Preparation;
/**
 * The gate. Returns the verdict when it passes; throws with the reason when it
 * does not — no verdict, a verdict over different bytes, a verdict against a
 * different baseline, or a verdict that failed.
 */
export declare function check({ bundle, verdict, baseline }: AuditOptions): Verdict;
/**
 * Record a clean verdict reached by reading the archive yourself. It writes the
 * same file the skill would, marked `by: 'human'`, so the gate treats both
 * identically while the record still says which happened.
 */
export declare function approve({ bundle, verdict, baseline, note }: AuditOptions & {
    /** What you checked — it becomes the verdict's summary. */
    note?: string | undefined;
}): Verdict;
//# sourceMappingURL=audit.d.ts.map