import { type ResultAuthorityContext, type ResultCommitBinding } from "./result-binding.js";
import type { Clock, KernelPaths } from "./types.js";
export type ResolveResultAuthorityInput = {
    readonly basis: "live";
    readonly clock: Clock;
    readonly taskId: string;
    readonly expectedVersion: number;
    readonly expectedSourceDigest: string;
    readonly expectedPolicyDigest: string;
    readonly deliveryAuthOperationId: string | null;
    readonly deliveryAuthDigest: string | null;
} | {
    readonly basis: "binding";
    readonly binding: ResultCommitBinding;
};
/**
 * Under-lock exact authority context (no result_commit).
 * basis:"live" loads current run/task; basis:"binding" uses immutable bind-time fields.
 */
export declare function resolveResultAuthorityUnlocked(paths: KernelPaths, input: ResolveResultAuthorityInput): ResultAuthorityContext;
/**
 * Exact authority + fingerprint + binding identity comparison.
 * Iterates RESULT_AUTHORITY_KEYS (not runtime Object.keys).
 */
export declare function assertBindingAuthority(binding: ResultCommitBinding, resolved: ResultAuthorityContext, resultCommit: string): void;
/** Load and exact-parse a journaled result_commit binding. */
export declare function loadResultCommitBinding(paths: KernelPaths, runId: string, resultCommitOperationId: string): ResultCommitBinding;