/**
 * Environment identity extraction and drift detection — the Phase 1
 * trust-on-first-use mechanism. The allowlist catches *new* environments;
 * the identity pin catches an enrolled environment name whose tenant
 * triple has been *swapped* underneath it.
 */
import type { EnvironmentConfiguration } from "../config/types.js";
import type { EnvIdentity } from "./types.js";
/**
 * Extract the pinnable identity (tenant triple + host) from an env
 * profile. Fields the profile doesn't carry are omitted, so the pin only
 * ever asserts what was actually known at enrollment time.
 */
export declare const extractIdentity: (env: EnvironmentConfiguration) => EnvIdentity;
/**
 * Compare a current identity against a pinned one. Only fields present in
 * the PIN are checked — the pin is the contract. A pinned field that is
 * missing or different in `current` counts as drift. Returns a list of
 * human-readable drift descriptions; an empty list means the identity
 * still matches.
 */
export declare const describeIdentityDrift: (pinned: EnvIdentity, current: EnvIdentity) => string[];
/** Whether `current` still matches everything the `pinned` identity asserts. */
export declare const identityMatchesPin: (pinned: EnvIdentity, current: EnvIdentity) => boolean;