/**
 * BehaviorDigest — Content-Addressed Behavioral Fingerprinting
 *
 * Produces a single SHA-256 digest that captures the complete
 * behavioral identity of a `ToolContract`. When this digest changes,
 * the tool's behavior has changed — even if the input schema,
 * tool name, and description remain identical.
 *
 * This is the foundation for the Capability Lockfile:
 * `mcp-fusion.lock` stores per-tool digests, and any change in
 * any digest triggers a lockfile update.
 *
 * **Content-addressed**: Two tools with identical behavior will
 * produce identical digests, regardless of creation order or runtime.
 *
 * Pure-function module: no state, no side effects.
 *
 * @module
 */
import type { ToolContract } from './ToolContract.js';
/**
 * Content-addressed digest of a tool's behavioral contract.
 *
 * The `digest` field is a SHA-256 over the canonical form of
 * all behavioral fields. The `components` field provides
 * per-section digests for granular change detection.
 */
export interface BehaviorDigestResult {
    /** Overall SHA-256 over all behavioral components */
    readonly digest: string;
    /** Per-section component digests */
    readonly components: DigestComponents;
    /** ISO-8601 timestamp of when the digest was computed */
    readonly computedAt: string;
    /** Tool name for correlation */
    readonly toolName: string;
}
/**
 * Per-section component digests for granular tracking.
 *
 * Each component is a SHA-256 of the canonical form of that
 * section. When the overall digest changes, comparing components
 * reveals exactly which section changed.
 */
export interface DigestComponents {
    /** SHA-256 of input surface (schema, actions) */
    readonly surface: string;
    /** SHA-256 of behavioral contract (egress, rules, guardrails) */
    readonly behavior: string;
    /** SHA-256 of token economics profile */
    readonly tokenEconomics: string;
    /** SHA-256 of handler entitlements */
    readonly entitlements: string;
}
/**
 * Server-level digest that covers all tools.
 *
 * Used as the content address for Capability Lockfile entries.
 */
export interface ServerDigest {
    /** SHA-256 over all per-tool digests (sorted by tool name) */
    readonly digest: string;
    /** Per-tool digests, keyed by tool name */
    readonly tools: Record<string, BehaviorDigestResult>;
    /** ISO-8601 timestamp */
    readonly computedAt: string;
}
/**
 * Compute the behavioral digest for a single tool contract.
 *
 * The digest is deterministic: same contract → same digest.
 * It uses canonical JSON serialization (sorted keys) to ensure
 * platform-independent consistency.
 *
 * @param contract - The materialized tool contract
 * @returns Content-addressed digest with per-section components
 */
export declare function computeDigest(contract: ToolContract): Promise<BehaviorDigestResult>;
/**
 * Compute a server-level digest covering all tools.
 *
 * The server digest is the SHA-256 over all per-tool digests,
 * sorted by tool name for determinism.
 *
 * @param contracts - Record of tool name → contract
 * @returns Server-level content-addressed digest
 */
export declare function computeServerDigest(contracts: Record<string, ToolContract>): Promise<ServerDigest>;
/**
 * Compare two server digests and return which tools changed.
 *
 * @param before - Previous server digest
 * @param after  - Current server digest
 * @returns Object with added, removed, and changed tool names
 */
export declare function compareServerDigests(before: ServerDigest, after: ServerDigest): DigestComparison;
/**
 * Result of comparing two server digests.
 */
export interface DigestComparison {
    /** Whether the overall server digest changed */
    readonly serverDigestChanged: boolean;
    /** Tools that were added */
    readonly added: readonly string[];
    /** Tools that were removed */
    readonly removed: readonly string[];
    /** Tools whose behavioral digest changed */
    readonly changed: readonly string[];
    /** Tools whose behavioral digest is identical */
    readonly unchanged: readonly string[];
}
//# sourceMappingURL=BehaviorDigest.d.ts.map