import { f as AuditEvent, S as StateBackend } from './types-iaO2gHBL.js';
export { A as Agent, a as AgentFilter, b as AgentId, c as AgentInput, d as AgentSignature, e as AgentStatus, g as AuditKind, h as AuditOptions, C as Capability, I as Issuer, K as Krikos, i as KrikosOptions, j as KvLike, R as RegistryStats, k as StateSnapshot, T as TelemetryEvent, l as TelemetryListener } from './types-iaO2gHBL.js';
export { a as assertValidCapability, c as capabilitiesAuthorize, b as capabilityAdmits, r as resourceMatches } from './match-CEAsPJMP.js';
export { A as ALLOWED_TRANSITIONS, K as KrikosError, c as canTransition, a as combineKeys, b as createKrikos, f as fnv1a64, i as isAuthorizableStatus, d as isTerminalStatus, k as kvState, m as memoryState } from './hash-CTRX0W0c.js';
export { A as AgentPassport, b as buildPassport, d as canonicalCapabilities, c as canonicalPassportString, a as computeFingerprint } from './fingerprint-Dv4gGA3L.js';

/**
 * Hash-chained audit trail primitives for Krikos.
 *
 * Every lifecycle operation appends one {@link AuditEvent}. Each event's `hash` folds the
 * previous event's `hash` together with this event's own fields, so the chain is tamper-evident:
 * altering any earlier event changes its `hash`, which breaks the `prevHash` link of the next
 * event, and so on to the head. {@link verifyAuditChain} walks the chain and reports whether it
 * is intact.
 *
 * This is integrity bookkeeping with a non-cryptographic digest (FNV-1a), strong enough to catch
 * accidental corruption and naive edits, not strong enough to resist a determined adversary who
 * can recompute the whole tail. A host that needs cryptographic non-repudiation signs the
 * snapshot or individual events with the Ed25519 signer. The events are also frozen with
 * `Object.freeze` on creation and on load, so a caller holding a reference cannot mutate history
 * in place.
 *
 * @packageDocumentation
 */

/** The prevHash of the first event: a fixed 16-zero sentinel, never a real digest. */
declare const GENESIS_HASH = "0000000000000000";
/**
 * Walks an audit trail and verifies the hash chain: each event's `prevHash` must equal the prior
 * event's `hash` (the first must be {@link GENESIS_HASH}), and each event's `hash` must equal the
 * recomputed digest of its content. An empty trail is trivially intact.
 *
 * @param events - The audit trail in sequence order.
 * @returns Whether the chain is intact.
 */
declare function verifyAuditChain(events: readonly AuditEvent[]): boolean;

/**
 * File state backend of Krikos: one JSON file on disk, written atomically, the persistence shape
 * for single-process Node hosts.
 *
 * This module is allowed to touch Node built-ins, and only through lazy dynamic imports inside
 * function bodies, so merely importing it stays safe in browsers and edge runtimes; the platform
 * requirement only materializes when `load` or `save` actually runs.
 *
 * @packageDocumentation
 */

/** Options of {@link fileState}. */
interface FileStateOptions {
    /** Filesystem path of the snapshot file, absolute or relative to the working directory. */
    readonly path: string;
}
/**
 * Creates a state backend persisting snapshots to one JSON file.
 *
 * Save is atomic via tmp-then-rename: the snapshot is written to a unique temp file and renamed
 * over `<path>`, so readers see either the old complete file or the new complete file, never a
 * torn write. Single-writer is the supported topology; two processes saving to the same path
 * race at the host's own risk. Missing parent directories are created.
 *
 * Load returns `undefined` when the file does not exist yet (ENOENT), the normal first-run case.
 * A present but unparseable or wrong-version file is quarantined aside (`<path>.corrupt-...`) and
 * the parse error is surfaced, so the next save never silently overwrites recoverable history.
 *
 * @param options - See {@link FileStateOptions}.
 */
declare function fileState(options: FileStateOptions): StateBackend;

export { AuditEvent, type FileStateOptions, GENESIS_HASH, StateBackend, fileState, verifyAuditChain as verifyAuditEvents };