import type { LedgerRecord } from '../core/record.js';
import type { LedgerHead } from '../store/ledger.js';
/**
 * attest = the CI gate. Given a run ledger (the "receipt") and the set of
 * files a PR actually changes, decide whether the receipt vouches for the
 * change: intact chain, valid signatures, and — the core check — every
 * changed file backed by a ledger claim. "No receipt, no review."
 *
 * Pure function: all I/O (reading ledgers, git diffs, key files) happens in
 * the CLI layer, which keeps every policy decision here unit-testable.
 */
export type AttestSeverity = 'error' | 'warning' | 'info';
export interface AttestFinding {
    readonly code: 'EMPTY_LEDGER' | 'CHAIN_BROKEN' | 'TRUNCATED' | 'SIG_INVALID' | 'NO_SIGNED_RECORDS' | 'UNSIGNED_RECORDS' | 'UNDECLARED_CHANGE' | 'OUT_OF_SCOPE' | 'CLAIMED_NOT_CHANGED' | 'LAST_TEST_CLAIM_FAILED';
    readonly severity: AttestSeverity;
    readonly message: string;
}
export interface AttestSummary {
    readonly records: number;
    readonly chainOk: boolean;
    readonly signed: number;
    readonly invalidSignatures: number;
    readonly changedFiles: number;
    readonly claimedFiles: number;
    readonly undeclared: readonly string[];
    readonly outOfScope: readonly string[];
}
export interface AttestVerdict {
    /** True when no error-severity findings exist (warnings pass unless strict). */
    readonly ok: boolean;
    readonly findings: readonly AttestFinding[];
    readonly summary: AttestSummary;
}
export interface AttestInput {
    readonly records: readonly LedgerRecord[];
    readonly head?: LedgerHead;
    readonly publicKeyPem?: string;
    /** Repo-relative paths the PR/worktree actually changes; omit to skip the diff gate. */
    readonly changedFiles?: readonly string[];
    readonly scopePatterns?: readonly string[];
    /** Absolute project root used to relativize claimed paths. */
    readonly projectRoot?: string;
    /** Paths exempt from the undeclared-change gate (the receipt itself, etc.). */
    readonly exemptPaths?: readonly string[];
    /** Treat warnings as failures. */
    readonly strict?: boolean;
}
export declare function attest(input: AttestInput): AttestVerdict;