/** What evidence actually establishes about an effect's reversibility.
 *  `unresolved` is an honest "not known yet", never silently upgraded. */
export type RealizedClass = 'tentative' | 'compensable' | 'irreversible' | 'unresolved';
/** The conservative class admission and the gateway act on. There is no
 *  `unresolved` here: the projection below folds it to `irreversible`. */
export type EnforcementClass = 'tentative' | 'compensable' | 'irreversible';
/** Pure projection realized -> enforcement (spec section 0).
 *  `unresolved` becomes `irreversible` (conservative, fail-closed). Every
 *  other value is the identity. This is the ONLY place `unresolved` is
 *  mapped to `irreversible`; realized truth is never rewritten. */
export declare function enforcementFrom(realized: RealizedClass): EnforcementClass;
/** The externality bucket an effect falls in. These values mirror the RAPV0
 *  TaskClassification.externality vocabulary (src/types/reputation-authority.ts)
 *  minus 'none'; a caller may pass RAPV0 values, and 'none' or an absent value
 *  is treated as unbound (see EffectFacts.externality). This is pattern reuse,
 *  not a shared type: reversibility is not a scalar of the effect location. */
export type EffectExternality = 'internal' | 'external-reversible' | 'external-irreversible';
/** Finality of an external effect. Used to decide whether an irreversible
 *  verdict is definitive or only an upper bound (spec section 4). */
export type FinalityState = 'settled' | 'pending' | 'expired' | 'contradicted';
/** A reversal-right attestation fact. To count, the signer MUST be a domain
 *  other than the acting principal (spec section 4). This step models the
 *  fact; it verifies no signature. A signer equal to the acting principal is
 *  self-attestation and does not establish the right. */
export interface ReversalRightFact {
    /** Identity/domain that attested the reversal right. */
    signer: string;
}
/** The raw facts a classifier consumes for one effect. Every field is
 *  optional: absence is meaningful and generally fails toward unresolved or,
 *  once the externality bucket is known, toward irreversible (fail-closed).
 *  This is the classifier input, not a receipt wire shape. */
export interface EffectFacts {
    /** The externality bucket. Absent (undefined) means unbound / missing and
     *  classifies as unresolved. A caller mapping RAPV0 'none' should pass it
     *  as undefined here. */
    externality?: EffectExternality;
    /** RESERVED for the deferred v4 section 10 four-object subsystem. Not consumed
     *  by the v0 classifier: v0 has no external-compensable path, so the acting
     *  principal plays no part in v0 classification. */
    actingPrincipal?: string;
    /** Who can invoke reversal (recovery_controller), a carried raw fact. Not
     *  consumed by the v0 classifier (v0 external is irreversible-only). */
    recoveryController?: string | null;
    /** RESERVED for the deferred v4 section 10 four-object subsystem. Not consumed
     *  by the v0 classifier. In v0 no reversal-right can ground compensability;
     *  external compensability is a future profile, not a v0 branch. */
    reversalRight?: ReversalRightFact | null;
    /** Finality of an external-irreversible effect. Only 'settled' contributes
     *  to a definitive (non-upper-bound) irreversible verdict. */
    finalityState?: FinalityState;
    /** Whether the target/counterparty binding is verified, for external-
     *  irreversible effects. Both finality and this must hold to drop the
     *  upper_bound label. */
    targetBindingVerified?: boolean;
    /** A producer-declared recovery mechanism reference. Carried as raw data only:
     *  in v0 it derives NOTHING about the class (v4 s4 / s4.1). A self-declared ref
     *  is self-attestation, so it cannot mint compensability; internal-compensable
     *  requires a verifier-checked recovery result that v0 defers. */
    recoveryMechanismRef?: string | null;
}
/** Deterministic reason codes for the v0 profile. One per mapping rule, so a
 *  verifier and an auditor read the same explanation for the same facts. Part of
 *  the profile's authoritative content (its reason-code set). */
export type ReasonCode = 'RM_V0_UNBOUND' | 'RM_V0_INTERNAL_DEFINITIVE' | 'RM_V0_INTERNAL_UPPER_BOUND' | 'RM_V0_EXTERNAL_DEFINITIVE' | 'RM_V0_EXTERNAL_UPPER_BOUND';
/** The result of a classification. The RealizedClass is the mapping output;
 *  `label` carries the section-4 upper_bound annotation, present only when an
 *  external verdict is not backed by verified finality and target binding; and
 *  `reason` is the deterministic reason code for the rule that fired. */
export interface ClassificationResult {
    realized: RealizedClass;
    label?: 'upper_bound';
    reason: ReasonCode;
}
/** A versioned mapping profile: a pure function from raw effect facts to a
 *  RealizedClass, addressed by a stable id. */
export interface ClassificationProfile {
    id: string;
    classify: (facts: EffectFacts) => ClassificationResult;
}
/** Stable id of the v0 mapping profile. Chosen value; the spec fixes no
 *  literal, only that classification_profile_id must be bound. */
export declare const REVERSIBILITY_MAPPING_V0_ID = "reversibility-mapping-v0";
/** The v0 mapping rules (v4 sections 4, 4.1, 10), as a pure function.
 *
 *  v0 has NO external-compensable path. External compensability is a FUTURE
 *  profile (reversibility-mapping-v1) built on the deferred four-object subsystem
 *  of v4 section 10, never a branch inside the v0 profile. v4 section 10 rejects
 *  the domain-separation-without-authority model (a non-empty reversal-right
 *  signer different from the principal): a registration outside operator control
 *  shows only separation, not authority-over-a-mechanism, so it cannot ground
 *  compensability. This profile must not behave differently by entry point.
 *
 *  - external-irreversible AND external-reversible -> irreversible. Upper bound
 *    (label upper_bound) unless finality is settled AND the target binding is
 *    verified. The two external buckets are treated identically in v0.
 *  - internal -> irreversible, treated exactly like an external-irreversible
 *    effect (upper_bound unless finality settled AND target binding verified). A
 *    self-declared recovery_mechanism_ref derives nothing (v4 s4 / s4.1), so v0
 *    has no internal-compensable path.
 *  - unbound / missing externality -> unresolved.
 *  v0 therefore emits no compensable outcome at all. */
export declare function classifyV0(facts: EffectFacts): ClassificationResult;
/** The v0 profile function object. */
export declare const reversibilityMappingV0: ClassificationProfile;
/** The AUTHORITATIVE, canonical content of the v0 profile (v4 section 4): its
 *  input schema, mapping rules, reason-code set, and time semantics, and nothing
 *  else. No runtime, diagnostic, or human-facing metadata (display name,
 *  comments, timestamps) is included, so those can change without changing the
 *  content digest. This object is what the digest commits to. */
export declare const REVERSIBILITY_PROFILE_V0_CONTENT: {
    profile_id: string;
    input_fields: string[];
    externality_values: string[];
    finality_values: string[];
    external_compensable: boolean;
    internal_compensable: boolean;
    rules: ({
        id: string;
        when: string;
        realized: string;
        reason: string;
        label?: undefined;
    } | {
        id: string;
        when: string;
        realized: string;
        label: string;
        reason: string;
    })[];
    reason_codes: string[];
    time_semantics: {
        clock_skew_ms: number;
        finality_source: string;
        target_binding_source: string;
    };
    schema_version: string;
};
/** Domain-separated content digest of a profile (v4 section 4):
 *  SHA-256( UTF8("APS-REVERSIBILITY-PROFILE-V0") || 0x00 || UTF8(JCS(content)) ).
 *  Any language that JCS-canonicalizes the same content reproduces this byte-for-
 *  byte. */
export declare function profileContentDigest(content: unknown): string;
/** The v0 profile's content digest. */
export declare const REVERSIBILITY_MAPPING_V0_DIGEST: string;
/** A registered profile: its function object, its authoritative content, its
 *  content digest, and non-authoritative diagnostic metadata that is NOT part of
 *  the digest. */
export interface RegisteredProfile {
    profile: ClassificationProfile;
    content: unknown;
    digest: string;
    /** Diagnostic/human-facing only. Excluded from the digest; may change freely. */
    metadata: {
        display_name: string;
        description: string;
    };
}
/** Resolve a mapping profile function by its classification_profile_id. Returns
 *  undefined for an unknown id (a distinct event from unbound facts). */
export declare function getClassificationProfile(id: string): ClassificationProfile | undefined;
/** Resolve the full registered profile (function, content, digest, metadata). */
export declare function getRegisteredProfile(id: string): RegisteredProfile | undefined;
/** The registry's content digest for a profile id, or undefined if unknown. */
export declare function getProfileDigest(id: string): string | undefined;
/** The set of registered profile ids. */
export declare function registeredProfileIds(): string[];
/** The outcome of checking a declared (id, digest) against the registry. Unknown
 *  id and digest mismatch are DISTINCT failures, never conflated. */
export type ProfileBindingCheck = {
    ok: true;
    digest: string;
} | {
    ok: false;
    reason: 'unknown_profile';
    classificationProfileId: string;
} | {
    ok: false;
    reason: 'digest_mismatch';
    classificationProfileId: string;
    declaredDigest: string;
    expectedDigest: string;
};
/** Check a declared profile id + content digest against the immutable registry.
 *  An id not in the registry fails unknown_profile; a known id whose declared
 *  digest does not equal the registry digest fails digest_mismatch. */
export declare function verifyProfileBinding(id: string, declaredDigest: string): ProfileBindingCheck;
/** Where an effect lands. Coarser than the classifier's externality bucket:
 *  the reversible-vs-irreversible distinction for an external effect is not a
 *  field an author sets, it is recomputed from the recovery facts (spec Q4:
 *  reversibility is not a scalar of the effect location). */
export type EffectScope = 'internal' | 'external';
/** Whether the effect's facts are established yet. Carried per section 3 and
 *  consumed by the two-stage lifecycle (a later step), not by this recompute. */
export type EvidenceStatus = 'resolved' | 'pending' | 'unavailable' | 'conflicted';
/** One instantiated effect. Raw facts only. */
export interface EffectInstantiationElement {
    effect_scope: EffectScope;
    effect_target_ref: string;
    finality_state: FinalityState;
    recovery_mechanism_ref: string | null;
    recovery_controller: string | null;
    recovery_deadline: string | null;
    evidence_status: EvidenceStatus;
    classification_profile_id: string;
    /** The content digest of the profile named by classification_profile_id (v4
     *  section 4). A recompute checks it against the immutable registry: a
     *  mismatch fails distinctly from an unknown profile. Binding the id to the
     *  digest proves which profile CONTENT governed the classification. */
    classification_profile_digest: string;
    /** Content-addressed request/action identity of the execution instance this
     *  effect belongs to (v4 section 2). Sourced from the carrying receipt's
     *  action_ref (ExecutionEnvelope.action_ref, the APS correlation key). A
     *  stable, signed binding so an effect state cannot be transplanted between
     *  receipts. */
    action_ref: string;
    /** Stable unique id of the specific execution instance (v4 section 2). Sourced
     *  from the carrying receipt's per-instance id (ExecutionEnvelope.action_id or
     *  RAPV0.receipt_id). Distinguishes two instances that share a content-
     *  addressed action_ref. */
    action_instance_id: string;
    /** Stable id for this effect across its lifecycle stages (v4 section 2).
     *  Precedence is defined by lineage under this id, never by array position. */
    effect_id: string;
    /** Hash of the prior signed state of THIS effect, or null on the first state.
     *  Chains an effect's lineage so a later state references its predecessor. */
    predecessor_effect_state_hash: string | null;
    /** Monotonic position within THIS effect's own lineage (not the array). */
    sequence: number;
    /** Optional cache ONLY. Never trusted. A verifier recomputes the realized
     *  class and any mismatch fails verification (verifyAssertedClass). */
    asserted_realized_class?: RealizedClass;
}
/** The effect-instantiation block: the effect vector (v0). */
export interface EffectInstantiationBlock {
    instantiated_effects: EffectInstantiationElement[];
}
/** RAPV0 TaskClassification.externality value space. Declared here to avoid
 *  coupling this primitive to the reputation type; the values mirror
 *  src/types/reputation-authority.ts TaskClassification.externality. */
export type RapvExternality = 'none' | 'internal' | 'external-reversible' | 'external-irreversible';
/** Map an RAPV0 externality onto the value used for EffectFacts.externality.
 *  'none' or absent -> undefined (unbound), which classifies unresolved.
 *  internal -> internal. Both external buckets -> external-irreversible: the
 *  legacy 'external-reversible' taxonomy carried a stronger meaning than v0
 *  grants, so it is NOT passed through as-is; mapping it to external-irreversible
 *  keeps it from being a backdoor into compensability (v4 s4/s10). This is a pure
 *  adapter, not an import-and-couple. */
export declare function rapvExternalityToEffectFacts(externality: RapvExternality | null | undefined): EffectExternality | undefined;
/** Verifier-supplied context for a recompute. Facts a verifier establishes
 *  out of band. Everything defaults to the fail-closed value when absent. */
export interface RecomputeOptions {
    /** HARD RULE: an author NEVER sets this from the block. Only a verifier that
     *  checked the resource_confirmation_ref cryptographic commitment (a later
     *  step) may pass true. Absent or false keeps an external-irreversible effect
     *  at irreversible + upper_bound. */
    targetBindingVerified?: boolean;
}
/** The outcome of a recompute. An unknown classification_profile_id is a
 *  DISTINCT failure from unbound facts: it is surfaced, never silently
 *  classified as unresolved. */
export type RecomputeOutcome = {
    status: 'recomputed';
    classificationProfileId: string;
    result: ClassificationResult;
} | {
    status: 'unknown_profile';
    classificationProfileId: string;
} | {
    status: 'profile_digest_mismatch';
    classificationProfileId: string;
    declaredDigest: string;
    expectedDigest: string;
};
/** Recompute the realized class for one effect element. Resolves the mapping
 *  profile by classification_profile_id; an unknown id is surfaced as its own
 *  failure and is NOT classified. Otherwise runs the profile over the element's
 *  facts and returns the ClassificationResult. */
export declare function recomputeEffect(element: EffectInstantiationElement, options?: RecomputeOptions): RecomputeOutcome;
/** Recompute every effect in a block, per element. No folding or collapsing to
 *  a maximum here (that is the fold, a later step). */
export declare function recomputeBlock(block: EffectInstantiationBlock, options?: RecomputeOptions): RecomputeOutcome[];
/** The result of checking an element's asserted cache class against the
 *  recompute. Absent cache passes. A present cache that differs from the
 *  recomputed realized class fails. An unknown profile cannot be verified. */
export type AssertedClassCheck = {
    ok: true;
    recomputed: ClassificationResult;
} | {
    ok: false;
    reason: 'mismatch';
    asserted: RealizedClass;
    recomputed: RealizedClass;
} | {
    ok: false;
    reason: 'unknown_profile';
    classificationProfileId: string;
} | {
    ok: false;
    reason: 'profile_digest_mismatch';
    classificationProfileId: string;
    declaredDigest: string;
    expectedDigest: string;
};
/** Verify an element's asserted cache class (if any) against the recompute.
 *  A cache is a convenience only and is never trusted: a mismatch fails. An
 *  unknown profile or a profile-digest mismatch cannot be verified and surfaces
 *  distinctly. */
export declare function verifyAssertedClass(element: EffectInstantiationElement, options?: RecomputeOptions): AssertedClassCheck;
/** Provisional stage. Append-only. */
export interface ExecutionStageReceipt {
    stage: 'execution';
    action_ref: string;
    run_id: string;
    /** The provisional class facts. */
    effect_instantiation: EffectInstantiationBlock;
    /** Stage-level evidence status. Provisional receipts are always pending. */
    evidence_status: 'pending';
    /** The enforcement class that GOVERNED admission, recorded by the gateway that
     *  admitted the action. Never rewritten by any later stage. */
    admitted_enforcement_class: EnforcementClass;
    created_at: string;
}
export interface ReconciliationSignature {
    algorithm: 'Ed25519';
    public_key: string;
    value: string;
}
/** Audit stage. Hash-linked to an execution receipt and signed. Carries the
 *  refined realized class, which has NO enforcement power. */
export interface ReconciliationStageReceipt {
    stage: 'reconciliation';
    /** SHA-256 hash-link to the execution receipt this refines. */
    execution_receipt_hash: string;
    action_ref: string;
    /** Audit-time realized class. Never gates admission. */
    realized_class: RealizedClass;
    /** Refined evidence status after reconciliation. */
    evidence_status: 'resolved' | 'unavailable' | 'conflicted';
    reconciled_at: string;
    signature: ReconciliationSignature;
}
/** SHA-256 (over strict JCS bytes) of an execution receipt. Any change to the
 *  execution receipt changes this hash, so a hash-link detects a rewrite. */
export declare function hashExecutionReceipt(receipt: ExecutionStageReceipt): string;
export interface CreateReconciliationInput {
    realized_class: RealizedClass;
    evidence_status: 'resolved' | 'unavailable' | 'conflicted';
    reconciled_at: string;
    signerPrivateKey: string;
    signerPublicKey: string;
}
/** Create a reconciliation receipt hash-linked to an execution receipt and
 *  signed over its canonical body. Does not touch the execution receipt. */
export declare function createReconciliationReceipt(execution: ExecutionStageReceipt, input: CreateReconciliationInput): ReconciliationStageReceipt;
export interface TransitionCheck {
    ok: boolean;
    errors: string[];
}
/** Validate a reconciliation against its execution receipt. Rejects a broken
 *  hash-link (a rewritten execution receipt), an invalid signature, a stage
 *  that is not pending, and any non-monotonic realized class. */
export declare function validateTransition(execution: ExecutionStageReceipt, reconciliation: ReconciliationStageReceipt): TransitionCheck;
/** The enforcement class that GOVERNED admission. This reads ONLY the execution
 *  receipt: the reconciliation's realized class is audit-time truth and carries
 *  no enforcement power, so a consumer cannot read the final class as the one
 *  that gated the action. */
export declare function admittedEnforcementClass(execution: ExecutionStageReceipt): EnforcementClass;
/** The signed authoritative fields of one effect state as a null-free object
 *  (v4 section 2). It commits to every signed field: effect_id, sequence,
 *  predecessor_effect_state_hash, the raw effect facts, classification_profile_id,
 *  classification_profile_digest, the evidence status, and the receipt/action
 *  binding (action_ref, action_instance_id). The asserted class is signed content
 *  and part of the state identity, so it is included when present, but it is
 *  non-authoritative for classification (a verifier recomputes). Computed
 *  verification outputs, the state hash itself, and out-of-object signatures are
 *  excluded: the builder reads only the known signed fields, so an extra property
 *  on the element object cannot enter the preimage. Only non-null fields are
 *  included, the same parity-safe rule the profile content follows, because the
 *  SDK JCS implementations diverge on null-valued keys. */
export declare function effectStatePreimage(el: EffectInstantiationElement): Record<string, unknown>;
/** Domain-separated hash of one effect state (v4 section 2):
 *  SHA-256( UTF8("APS-REVERSIBILITY-EFFECT-STATE-V0") || 0x00 || UTF8(JCS(preimage)) )
 *  over the null-free preimage of every signed authoritative field. Chains a
 *  lineage: a later state's predecessor_effect_state_hash references this. Any
 *  language that JCS-canonicalizes the same preimage reproduces it byte-for-byte. */
export declare function hashEffectState(element: EffectInstantiationElement): string;
/** Deterministic derivation of an effect_id (v4 section 2):
 *  base64url( SHA-256( UTF8("APS-REVERSIBILITY-EFFECT-ID-V0") || 0x00 ||
 *  UTF8(JCS({action_ref, action_instance_id, local_effect_id})) ) ), where
 *  local_effect_id is unique within the receipt and STABLE across retries (an
 *  id, not a nonce). The id is a function of stable inputs, so a retry produces
 *  the same effect_id and the same lineage identity. */
export declare function deriveEffectId(action_ref: string, action_instance_id: string, local_effect_id: string): string;
/** The typed outcome of lineage validation (v4 section 2, corrected).
 *  - ok: a single rooted, gap-free, correctly chained lineage per effect_id.
 *  - lineage_incomplete: a gap in sequences, a non-zero origin, or no root
 *    (missing states).
 *  - lineage_conflicted: a fork, where one predecessor state has two distinct
 *    successors.
 *  - equivocation: two distinct roots share an effect_id (multiple-roots), or two
 *    states occupy the same (effect_id, sequence) with different hashes without a
 *    shared predecessor. Named as the provable condition; it is NOT a claim about
 *    a semantic collision between unrelated effects.
 *  - invalid_state: a state at sequence n>0 whose predecessor_effect_state_hash
 *    does not equal the hash of the state at n-1 (a broken chain link). */
export type LineageStatus = 'ok' | 'lineage_incomplete' | 'lineage_conflicted' | 'equivocation' | 'invalid_state';
export interface LineageResult {
    status: LineageStatus;
    /** Exact-duplicate states (identical full effect-state hash) removed before
     *  the graph checks, aggregated across all effect_ids in the block. */
    duplicate_count: number;
}
/** Validate the identity and lineage structure of a block, independent of array
 *  order (v4 section 2, corrected). Returns a TYPED status plus a duplicate_count.
 *  The block is ok only when every effect_id's lineage is ok; otherwise the
 *  status is that of the lexicographically first non-ok effect_id (deterministic).
 *  This validates identity only; the lineage-based fold reading (classify from
 *  the latest lineage state per effect_id) is the fold, not built here. */
export declare function validateEffectLineage(block: EffectInstantiationBlock): LineageResult;
/** The latest valid state per effect_id, but ONLY for an ok lineage. Returns
 *  undefined for any non-ok block, so a caller cannot pull a latest state from an
 *  incomplete, conflicted, equivocating, or invalid lineage. Order-invariant. */
export declare function latestValidEffectStates(block: EffectInstantiationBlock): Map<string, EffectInstantiationElement> | undefined;
//# sourceMappingURL=reversibility-fold.d.ts.map