/**
 * Secure, host-neutral projection of terminal workflow artifacts.
 *
 * Journal entries are audit data, not filesystem authority. This module
 * derives the only allowed artifact paths from the validated attempt identity,
 * revalidates the manifest, and returns hash-bound snapshots for consumers.
 */
import type { Manifest, ValidateManifest } from './artifact-contract.js';
import type { V3Dag } from './dag.js';
export interface PortableWorkflowFinalOutput {
    nodeId: string;
    instanceId?: string;
    attemptId: string;
    /** Canonical path to the revalidated sink manifest. */
    manifestPath: string;
    /** SHA-256 of the exact manifest bytes validated for this projection. */
    manifestSha256: string;
    /** A detached snapshot of the validated manifest. */
    manifest: Manifest;
    /** Canonical directory containing the sink's validated files. */
    outputDir: string;
    /** Canonical path when the sink manifest publishes `result.json`. */
    resultPath?: string;
    /** SHA-256 of the exact `result.json` bytes captured by this projection. */
    resultSha256?: string;
    /** Parsed snapshot of `result.json`; prefer this over reopening resultPath. */
    resultJson?: unknown;
}
/**
 * Reconstruct final sink artifacts without trusting journal-supplied paths.
 *
 * This intentionally fails closed when a successful sink's artifact binding
 * cannot be reproved. Callers receive parsed/hash-bound snapshots so a later
 * filesystem replacement cannot silently change the delivered result.
 */
export declare function readPortableWorkflowFinalOutputs(dag: V3Dag, runDir: string, validateManifest: ValidateManifest): Promise<PortableWorkflowFinalOutput[]>;
//# sourceMappingURL=portable-final-outputs.d.ts.map