/**
 * Ledger-aware activation identity resolution (Phase 3 Option A′ — I2+I3).
 *
 * Owner review of PR #1856 (P1 × 3): the UUID-shape-only boundary shipped in
 * I3 refused artifacts that carry no stamped identity, while the production
 * chain (ScribeRunner) did not stamp one yet — the new gate cut the live
 * production chain and the E2E "passed" only because the test stamped a
 * synthetic identity by hand. This module implements the missing half of the
 * ADR (§6 Phase 1): the identity is resolved against the LEDGER, either
 *
 *   1. `direct` — the artifact's `source_principle_id` when it is a
 *      ledger-shaped UUID **and** the ledger actually contains that principle
 *      (shape alone never proves membership), or
 *   2. `candidate_lineage` — the structural chain scribe → dreamer artifact →
 *      dreamer task seed (`candidateId`) → ledger principle(s) derived from
 *      that candidate. Ambiguity (0 or >1 ledger matches) stays unresolved —
 *      never guessed.
 *
 * This is the activation-boundary counterpart of PRI-768 v5 F4's
 * `resolveLedgerPrincipleId` (pd-console), which until now only ran AFTER the
 * activation commit as a non-fatal ledger upgrade.
 */
import type { PIArtifactSnapshot } from './activation-types.js';
/** The subset of PrincipleTreeLedgerAdapter the boundary needs. */
export interface LedgerIdentityChecker {
    /**
     * PRI-915: whether the ledger backing store is readable right now. When
     * `false`, the membership answers below collapse to an empty ledger, so a
     * `false`/`[]` result means "cannot read" — never data drift.
     */
    isAvailable(): boolean;
    hasPrinciple(principleId: string): boolean;
    listForCandidate(candidateId: string): {
        id: string;
    }[];
}
export interface LedgerIdentityLookupDeps {
    ledger: LedgerIdentityChecker;
    getArtifactById: (artifactId: string) => Promise<PIArtifactSnapshot | null>;
    /**
     * Read one task's diagnostic_json. May be sync or async (hosts back it with
     * either raw SQLite reads or RuntimeStateManager.getTask). Optional: when
     * absent the resolver falls back to deriving the candidateId from the
     * dreamer task id spelling (`dreamer-<candidateId>-<channel>`, PRI-720
     * bridge naming).
     */
    getTaskDiagnosticJson?: (taskId: string) => string | null | Promise<string | null>;
}
export type LedgerActivationResolution = {
    status: 'resolved';
    principleId: string;
    how: 'direct_validated' | 'candidate_lineage';
} | {
    status: 'unresolved';
    reason: string;
};
/** Candidate id embedded in a dreamer task id ("dreamer-<uuid>-<channel>"). */
export declare function candidateIdFromDreamerTaskId(taskId: string | null | undefined): string | null;
/**
 * Read the candidate id carried at the top level of a dreamer task seed's
 * diagnostic_json (written by intake-to-internalization-bridge). Shared by the
 * activation boundary and the scribe's chain stamping.
 */
export declare function candidateIdFromDreamerSeed(diagnosticJson: string | null | undefined): string | null;
/**
 * Resolve the ledger principle identity for an activation artifact.
 *
 * Order: ledger availability → direct UUID (ledger-validated) → candidate
 * lineage. Direct ids that fail ledger membership do NOT fall through to the
 * lineage — a stamped id that a READABLE ledger does not know is data drift
 * and must surface as such. An UNREADABLE ledger is not drift: it is
 * reported as `ledger_unavailable` so the caller can retry after repair
 * (PRI-915) instead of misattributing a transient outage.
 */
export declare function resolveLedgerActivationId(artifact: PIArtifactSnapshot, deps: LedgerIdentityLookupDeps): Promise<LedgerActivationResolution>;
//# sourceMappingURL=ledger-identity.d.ts.map