import type { MemoryCanaryEntry, MemoryCanaryVerification } from "../types.js";
export interface MintMemoryCanaryOptions {
    /**
     * Override token byte length. Minimum 8 (16 hex chars). Default 16.
     * Longer = stronger guessing resistance, but the hex string lives in
     * sidecar storage so the overhead is negligible.
     */
    tokenBytes?: number;
}
/**
 * Mint a canary for a memory entry. Call at write time, persist the
 * returned `MemoryCanaryEntry` alongside (or in place of) the raw entry.
 *
 * @param id        Stable identifier of the memory entry.
 * @param content   The content being stored.
 * @param tenantId  Optional tenant scope.
 */
export declare function mintMemoryCanary(id: string, content: string, tenantId?: string, options?: MintMemoryCanaryOptions): MemoryCanaryEntry;
/**
 * Verify a previously minted canary against the content read back from
 * storage. Returns `valid: true` only if both the content matches what
 * was sealed and the tenant binding (if any) matches.
 *
 * Use case 1 — mutation detection:
 * ```ts
 * const entry = mintMemoryCanary("fact:42", "Sky is blue.");
 * await db.write({ ...entry });
 *
 * // ... later ...
 * const stored = await db.read("fact:42");
 * const ver = verifyMemoryCanary(stored, stored.content);
 * if (!ver.valid) {
 *   logger.security("Memory poisoning suspected", { id, reason: ver.reason });
 * }
 * ```
 *
 * Use case 2 — cross-tenant leak detection:
 * ```ts
 * // tenant A reads what should be a tenant-B-only entry
 * const ver = verifyMemoryCanary(entry, entry.content, { tenantId: "tenant-A" });
 * // ver.reason === "tenant_mismatch"
 * ```
 */
export declare function verifyMemoryCanary(entry: MemoryCanaryEntry, observedContent: string, options?: {
    tenantId?: string;
}): MemoryCanaryVerification;
/**
 * Re-mint a canary after legitimate content edit. Returns a new
 * sealed entry that supersedes the old one. The old `canaryToken`
 * is rotated so a replay of the previous hash is also invalidated.
 */
export declare function rotateMemoryCanary(prev: MemoryCanaryEntry, newContent: string): MemoryCanaryEntry;
/**
 * Inject a *sentinel* memory entry — a decoy fact whose mutation would
 * indicate the store was tampered with. Pair with `findSentinelMutations()`
 * in a periodic sweep over the memory store.
 *
 * Returns a `MemoryCanaryEntry` with deterministic content that callers
 * can recognise. The content includes the canary token so even content
 * inspection (not just hash compare) catches mutation.
 */
export declare function buildSentinelEntry(scope: string, tenantId?: string): MemoryCanaryEntry;
/**
 * Bulk verify a set of stored entries against their canaries. Returns
 * the IDs that failed verification, with the reason.
 */
export declare function bulkVerify(entries: Array<{
    canary: MemoryCanaryEntry;
    observedContent: string;
    expectedTenantId?: string;
}>): Array<{
    id: string;
    reason: NonNullable<MemoryCanaryVerification["reason"]>;
}>;
//# sourceMappingURL=memory.d.ts.map