import { z } from 'zod';
/**
 * One ledger record = one observed event in an agent run, hash-chained to its
 * predecessor. The shape is designed to map onto the concepts in IETF
 * draft-sharif-agent-audit-trail-00 (agent identity, action classification,
 * outcome, SHA-256 chaining) without claiming conformance to a moving draft.
 */
export declare const ACTION_CLASSES: readonly ["read", "write", "exec", "net", "vcs", "agent", "other"];
export type ActionClass = (typeof ACTION_CLASSES)[number];
export declare const claimSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
    type: z.ZodLiteral<"test_run">;
    command: z.ZodString;
    /** ok = explicit pass signal and no fail signal; failed = explicit fail; unknown otherwise. */
    outcome: z.ZodEnum<["ok", "failed", "unknown"]>;
    summary: z.ZodString;
}, "strip", z.ZodTypeAny, {
    type: "test_run";
    command: string;
    outcome: "unknown" | "ok" | "failed";
    summary: string;
}, {
    type: "test_run";
    command: string;
    outcome: "unknown" | "ok" | "failed";
    summary: string;
}>, z.ZodObject<{
    type: z.ZodLiteral<"file_change">;
    path: z.ZodString;
    via: z.ZodString;
}, "strip", z.ZodTypeAny, {
    type: "file_change";
    path: string;
    via: string;
}, {
    type: "file_change";
    path: string;
    via: string;
}>, z.ZodObject<{
    type: z.ZodLiteral<"git_op">;
    op: z.ZodString;
    command: z.ZodString;
}, "strip", z.ZodTypeAny, {
    type: "git_op";
    command: string;
    op: string;
}, {
    type: "git_op";
    command: string;
    op: string;
}>]>;
export type Claim = z.infer<typeof claimSchema>;
export declare const ledgerRecordSchema: z.ZodObject<{
    v: z.ZodLiteral<1>;
    seq: z.ZodNumber;
    ts: z.ZodString;
    session: z.ZodString;
    agent: z.ZodObject<{
        harness: z.ZodString;
        model: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        harness: string;
        model?: string | undefined;
    }, {
        harness: string;
        model?: string | undefined;
    }>;
    event: z.ZodEnum<["session_start", "prompt", "tool_use", "stop", "session_end", "checkpoint", "note"]>;
    action: z.ZodOptional<z.ZodObject<{
        tool: z.ZodString;
        class: z.ZodEnum<["read", "write", "exec", "net", "vcs", "agent", "other"]>;
        input_digest: z.ZodString;
        summary: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        summary: string;
        tool: string;
        class: "read" | "write" | "exec" | "net" | "vcs" | "agent" | "other";
        input_digest: string;
    }, {
        summary: string;
        tool: string;
        class: "read" | "write" | "exec" | "net" | "vcs" | "agent" | "other";
        input_digest: string;
    }>>;
    outcome: z.ZodOptional<z.ZodObject<{
        status: z.ZodEnum<["ok", "error", "unknown"]>;
        output_digest: z.ZodOptional<z.ZodString>;
        detail: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        status: "unknown" | "ok" | "error";
        output_digest?: string | undefined;
        detail?: string | undefined;
    }, {
        status: "unknown" | "ok" | "error";
        output_digest?: string | undefined;
        detail?: string | undefined;
    }>>;
    claims: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
        type: z.ZodLiteral<"test_run">;
        command: z.ZodString;
        /** ok = explicit pass signal and no fail signal; failed = explicit fail; unknown otherwise. */
        outcome: z.ZodEnum<["ok", "failed", "unknown"]>;
        summary: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        type: "test_run";
        command: string;
        outcome: "unknown" | "ok" | "failed";
        summary: string;
    }, {
        type: "test_run";
        command: string;
        outcome: "unknown" | "ok" | "failed";
        summary: string;
    }>, z.ZodObject<{
        type: z.ZodLiteral<"file_change">;
        path: z.ZodString;
        via: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        type: "file_change";
        path: string;
        via: string;
    }, {
        type: "file_change";
        path: string;
        via: string;
    }>, z.ZodObject<{
        type: z.ZodLiteral<"git_op">;
        op: z.ZodString;
        command: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        type: "git_op";
        command: string;
        op: string;
    }, {
        type: "git_op";
        command: string;
        op: string;
    }>]>, "many">>;
    meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    prev: z.ZodString;
    hash: z.ZodString;
    /**
     * Optional ECDSA P-256 signature (base64 DER) over `hash`. Absent on records
     * written before a signing key existed — those stay valid forever.
     */
    sig: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    v: 1;
    agent: {
        harness: string;
        model?: string | undefined;
    };
    seq: number;
    ts: string;
    session: string;
    event: "session_start" | "prompt" | "tool_use" | "stop" | "session_end" | "checkpoint" | "note";
    prev: string;
    hash: string;
    outcome?: {
        status: "unknown" | "ok" | "error";
        output_digest?: string | undefined;
        detail?: string | undefined;
    } | undefined;
    action?: {
        summary: string;
        tool: string;
        class: "read" | "write" | "exec" | "net" | "vcs" | "agent" | "other";
        input_digest: string;
    } | undefined;
    claims?: ({
        type: "test_run";
        command: string;
        outcome: "unknown" | "ok" | "failed";
        summary: string;
    } | {
        type: "file_change";
        path: string;
        via: string;
    } | {
        type: "git_op";
        command: string;
        op: string;
    })[] | undefined;
    meta?: Record<string, unknown> | undefined;
    sig?: string | undefined;
}, {
    v: 1;
    agent: {
        harness: string;
        model?: string | undefined;
    };
    seq: number;
    ts: string;
    session: string;
    event: "session_start" | "prompt" | "tool_use" | "stop" | "session_end" | "checkpoint" | "note";
    prev: string;
    hash: string;
    outcome?: {
        status: "unknown" | "ok" | "error";
        output_digest?: string | undefined;
        detail?: string | undefined;
    } | undefined;
    action?: {
        summary: string;
        tool: string;
        class: "read" | "write" | "exec" | "net" | "vcs" | "agent" | "other";
        input_digest: string;
    } | undefined;
    claims?: ({
        type: "test_run";
        command: string;
        outcome: "unknown" | "ok" | "failed";
        summary: string;
    } | {
        type: "file_change";
        path: string;
        via: string;
    } | {
        type: "git_op";
        command: string;
        op: string;
    })[] | undefined;
    meta?: Record<string, unknown> | undefined;
    sig?: string | undefined;
}>;
export type LedgerRecord = z.infer<typeof ledgerRecordSchema>;
/** Sealing input: everything except the seal (`hash`) and the seal's signature (`sig`). */
export type UnhashedRecord = Omit<LedgerRecord, 'hash' | 'sig'>;
/**
 * Hash covers every field except `hash` itself and `sig`; `prev` is inside,
 * forming the chain. `sig` MUST stay outside the hashed content: it is a
 * signature computed over this very hash, so hashing it back in would be
 * circular (the hash would change the moment it is signed). Stripping both
 * keys here keeps the hash identical whether the record is unhashed, sealed,
 * or signed — which is what keeps pre-signing ledgers verifiable.
 */
export declare function computeRecordHash(record: UnhashedRecord | LedgerRecord): string;
export declare function sealRecord(record: UnhashedRecord): LedgerRecord;
/** Recompute and compare; returns false on any structural or hash mismatch. */
export declare function recordHashValid(record: LedgerRecord): boolean;