export declare const APPROVAL_SCHEMA_VERSION = "phase05-approval-envelope-v1";
export type HermesApprovalPacketErrorCode = "approval_packet_required" | "approval_root_insecure" | "approval_packet_outside_root" | "approval_packet_insecure" | "approval_packet_invalid" | "approval_packet_pending" | "approval_hash_mismatch" | "approval_actor_unauthorized" | "approval_request_mismatch" | "approval_request_unresolved" | "approval_identity_missing";
export declare class HermesApprovalPacketError extends Error {
    readonly code: HermesApprovalPacketErrorCode;
    constructor(code: HermesApprovalPacketErrorCode);
    toJSON(): {
        name: string;
        code: HermesApprovalPacketErrorCode;
        message: string;
    };
}
export interface HermesApprovalEnvelope {
    schemaVersion: string;
    requestId: string;
    request: Record<string, unknown>;
}
export interface HermesApprovalIdentity {
    approvalRequestId: string;
    approvalRequestHash: string;
    approvalPacketRef: string;
}
export interface LoadedHermesApprovalPacket extends HermesApprovalIdentity {
    request: Record<string, unknown>;
    approvedAt: string;
    approvedBy: string;
    approvalEventRef: string;
}
interface LoadHermesApprovalPacketOptions {
    approvalPacketFile: string;
    adminHome: string;
    authorizedActors?: string[];
    /** Test-only ownership injection. Production callers omit this. */
    expectedUid?: number | null;
}
export declare class SecureOwnedJsonError extends Error {
    readonly code: "secure_json_insecure" | "secure_json_unreadable";
    constructor(code: "secure_json_insecure" | "secure_json_unreadable");
}
export interface ReadSecureOwnedJsonOptions {
    file: string;
    root: string;
    expectedUid?: number | null;
}
export declare function canonicalJsonHash(value: unknown): string;
export declare function canonicalApprovalHash(envelope: HermesApprovalEnvelope): string;
export declare function assertSecureOwnedDirectory(directory: string, expectedUid?: number | null): void;
export declare function readSecureOwnedJson(options: ReadSecureOwnedJsonOptions): unknown;
export declare function assertResolvedApprovalRequest(request: unknown): asserts request is Record<string, unknown>;
export declare function assertApprovalIdentity(actual: unknown, expected: HermesApprovalIdentity): void;
export declare function loadHermesApprovalPacket(options: LoadHermesApprovalPacketOptions): LoadedHermesApprovalPacket;
export {};