/**
 * Where submissions live for one draw: the repository root a bound path is
 * expressed relative to, and the directory the payload files sit in.
 */
export interface SubmissionRoots {
    readonly root: string;
    readonly submissionDir: string;
}
/** The identity components a submission id is derived from. */
export interface SubmissionIdParts {
    /** The obligation/gate family the submission answers. */
    readonly kind: string;
    /** The content-coherent lane within that family. */
    readonly lane: string;
    /** The run (or run-equivalent scope) the lane belongs to. */
    readonly runId: string;
}
/**
 * Mint the submission id for one lane. DETERMINISTIC: the same kind + lane +
 * run always yields the same id, so a re-emitted step re-declares the identical
 * bound path and an already-satisfied lane is recognized on resume (K-of-N).
 * No timestamp, no randomness — an id that changed per call would re-ask for
 * work the host already delivered.
 *
 * The readable prefix is for humans reading the ledger; the trailing digest is
 * what makes distinct lanes distinct.
 */
export declare function mintSubmissionId(parts: SubmissionIdParts): string;
/**
 * Absolute on-disk path of one submission payload.
 *
 * The containment of the landing path is CHECKED, never inferred from the fact
 * that `submissionFilename` happens to hash. Hashing is what makes an escape
 * impossible today; `resolveContainedPath` is what makes it impossible to
 * REINTRODUCE one — a future filename derivation that passed the id through
 * would otherwise steer a write outside `submissionDir` with nothing going red.
 * The refusal fires here, before any caller has a path to write to.
 */
export declare function absoluteSubmissionPath(paths: SubmissionRoots, submissionId: string): string;
/**
 * The bound path as it is declared in a step contract and rendered to a host:
 * repository-relative and forward-slashed, so the same contract reads
 * identically on win32 / darwin / linux.
 */
export declare function submissionPathFor(paths: SubmissionRoots, submissionId: string): string;
/**
 * Resolve `candidate` against `base` and refuse anything that escapes it. The
 * containment rule both host handoffs hand-rolled.
 */
export declare function resolveContainedPath(base: string, candidate: string, label: string): string;
/** Repository-relative, forward-slashed form of a contained absolute path. */
export declare function repoRelativePath(root: string, absolutePath: string, label: string): string;
/**
 * The shared run-id grammar. A run id becomes a directory segment, so it may
 * carry nothing that could climb out of the artifacts tree.
 */
export declare function assertSubmissionRunId(runId: string, label?: string): void;
//# sourceMappingURL=submissionIdentity.d.ts.map