import type { RepoSnapshot } from "../context/index.js";
import type { NormalizedPolicy, PolicyDecision, PolicyIsolation, PolicyNetworkAccess } from "../policy/index.js";
import type { AcceptanceCriterion, AcceptanceResult, AcceptanceSummary, AdapterAttestationCitation, AdapterEvidenceCapability, ResultDigest, SpawnFailureClass, WorkflowAgentProof, WorkflowAttemptContext, WorkflowDiagnosticAdmissionProof, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowProof, WorkflowSandboxProjectionEvidence, WorkflowWorkContext } from "./types.js";
import type { WorkspaceAttestation, WorkspaceBinding, WorkspaceCompatibilityExecutionEvidence } from "./workspaces/index.js";
export interface NormalizedWorkflowMeta {
    name: string;
    description?: string;
    objective?: string;
    acceptance: AcceptanceCriterion[];
}
export interface BuildWorkflowProofInput {
    runId: string;
    workItemId?: string;
    workContext?: Readonly<WorkflowWorkContext>;
    attemptContext?: Readonly<WorkflowAttemptContext>;
    meta: NormalizedWorkflowMeta;
    status: "succeeded" | "failed";
    startedAt: string;
    endedAt: string;
    durationMs: number;
    transcriptPath: string;
    before: RepoSnapshot;
    after: RepoSnapshot;
    agents: WorkflowAgentProof[];
    evidence: WorkflowEvidenceRecord[];
    diagnosticAdmission?: WorkflowDiagnosticAdmissionProof;
    adapterEvidence?: Readonly<Record<string, AdapterEvidenceCapability | undefined>>;
    /** Filesystem policy actually projected into children (ADR 0039). */
    sandboxProjection?: WorkflowSandboxProjectionEvidence;
    /** Live attestations backing each adapter's claims (ADR 0038). Injected by
     * the caller so proof stays free of filesystem lookups. */
    adapterAttestations?: Readonly<Record<string, AdapterAttestationCitation | undefined>>;
    policy?: {
        config: Readonly<NormalizedPolicy>;
        decisions: readonly PolicyDecision[];
        isolation: PolicyIsolation;
        networkAccess: PolicyNetworkAccess;
    };
    /** Set when the script called ctx.blocked(): the run stopped because a human
     * must rule. Forces run class "decision" regardless of the agents' classes. */
    blocked?: {
        reason: string;
        decisionId?: string;
    };
    workspaceBinding?: WorkspaceBinding;
    workspaceAttestation?: WorkspaceAttestation;
    workspaceFallback?: WorkspaceCompatibilityExecutionEvidence;
    result?: unknown;
    error?: string;
}
export declare function normalizeWorkflowMeta(meta: WorkflowMeta | undefined, fallbackName: string): NormalizedWorkflowMeta;
export declare function createEvidenceRecord(input: {
    value: WorkflowEvidenceInput;
    sequence: number;
    acceptanceIds: ReadonlySet<string>;
    stage?: string;
    recordedAt?: string;
}): WorkflowEvidenceRecord;
export declare function rollupAcceptance(criteria: AcceptanceCriterion[], evidence: WorkflowEvidenceRecord[]): {
    criteria: AcceptanceResult[];
    summary: AcceptanceSummary;
};
export declare function digestResult(value: unknown, kind?: "text" | "json"): ResultDigest;
/**
 * The run-level failure class (ADR 0046), derived from the agents rather than a
 * single terminal throw so it survives a script's `parallel()` swallowing the
 * rejection — a swallowed agent's proof is still recorded with its class.
 *
 * Rules, in order, all in service of "default to charging":
 * 1. A succeeded run is never classed (there is nothing uncharged about it).
 * 2. If ANY agent produced a result (succeeded or replayed from cache) the
 *    attempt was informative about the work — charge it. This also keeps a
 *    resumed run whose earlier segment did real work from being written off by
 *    a later environment failure.
 * 3. Otherwise, among the failed agents, environment wins over upstream: a
 *    missing binary means nothing ran at all, and it is the operator-chosen
 *    hard stop.
 * 4. Anything else is undefined ⇒ a charged work failure, exactly as today.
 */
export declare function deriveRunFailureClass(status: "succeeded" | "failed", agents: readonly Pick<WorkflowAgentProof, "status" | "class">[]): SpawnFailureClass | undefined;
export declare function buildWorkflowProof(input: BuildWorkflowProofInput): WorkflowProof;
export declare function writeWorkflowProof(path: string, proof: WorkflowProof): void;
export declare function readWorkflowProof(coordRoot: string, runId: string): WorkflowProof;
export declare function renderWorkflowProof(proof: WorkflowProof): string;
//# sourceMappingURL=proof.d.ts.map