/**
 * The opt-in live probe that produces an attestation (ADR 0038).
 *
 * One bounded probe per adapter, through the same `spawn` the workflow engine
 * uses, so what gets attested is the path production takes rather than a
 * parallel test rig. The probe permits a small tool-iteration budget because
 * repository instructions can require workflow children to register before
 * replying; a one-iteration ceiling made a healthy Claude CLI look unreachable.
 */
import type { SpawnResult } from "../workflow/types.js";
import { probeFilesystemProjection } from "./attest-projection.js";
import type { AdapterAttestation, AttestableDimension } from "./attestation.js";
import type { AdapterRegistry } from "./registry.js";
import type { AdapterId, CapabilitySupport } from "./types.js";
/** Fixed and content-free, so nothing user-supplied can reach the record and
 * the turn stays as cheap as a turn can be. */
export declare const ATTESTATION_PROMPT = "Reply with the single word: ok";
export declare const DEFAULT_ATTESTATION_TIMEOUT_MS = 120000;
export declare const ATTESTATION_MAX_TURNS = 4;
export type AttestationOutcome = "recorded" | "skipped" | "unreachable" | "failed";
export interface AdapterAttestationResult {
    adapter: AdapterId;
    outcome: AttestationOutcome;
    binaryVersion?: string;
    observations?: Partial<Record<AttestableDimension, CapabilitySupport>>;
    durationMs?: number;
    note: string;
}
export interface AdapterAttestationReport {
    generatedAt: string;
    adapters: AdapterId[];
    results: AdapterAttestationResult[];
    recorded: number;
    /** True when at least one selected adapter could not be attested, so a
     * caller can tell a partial sweep from a complete one. */
    incomplete: boolean;
}
export interface RunAdapterAttestationOptions {
    adapters?: readonly string[];
    timeoutMs?: number;
    cwd?: string;
    coordRoot?: string;
    /** Scrub API-key vars from the child so it can only use its stored login,
     * matching `workflow run --subscription-only`. The observation is recorded
     * against this mode, because a child that may fall back to an API key can
     * behave differently from one that may not. */
    subscriptionOnly?: boolean;
    /** Test seam and alternate host probe. A null version means unavailable. */
    versionProbe?: (binary: string) => string | null;
    /** Test seam. Defaults to the adapter's production spawner. */
    spawn?: (adapter: AdapterId, prompt: string, timeoutMs: number) => Promise<SpawnResult>;
    /** Test seam. Defaults to writing under the coord root. */
    persist?: (record: AdapterAttestation) => void;
    /**
     * Also probe `filesystemPolicyProjection` (ADR 0041). Off by default because
     * it costs two extra turns per capable adapter, against one for everything
     * else: the observation needs a control run to be readable at all.
     */
    projection?: boolean;
    /** Test seam for the projection probe. */
    probeProjection?: typeof probeFilesystemProjection;
    now?: () => Date;
}
export declare function runAdapterAttestation(registry: AdapterRegistry, opts?: RunAdapterAttestationOptions): Promise<AdapterAttestationReport>;
//# sourceMappingURL=attest.d.ts.map