/**
 * Reading the sha256-locked PRD handoff capsule and the project-level security
 * template. Split out of `security-audit-service.ts` so the audit service and
 * the declaration's producer can both depend on the readers without depending
 * on each other.
 */
/**
 * Handoff frontmatter — minimal projection of the peaks-prd v2.11.0 handoff
 * frontmatter. We only need sha256 for verification; the rest of the handoff
 * body is consumed by the parent LLM, not by this service.
 */
export interface HandoffFrontmatter {
    readonly sha256: string;
    readonly schemaVersion: number;
}
/**
 * Read the peaks-prd handoff frontmatter + body, verify sha256 matches
 * the body. Returns null on missing file or sha256 mismatch; otherwise
 * returns the parsed frontmatter + body string.
 *
 * Defensive: we read frontmatter via a 1-line regex match, not via
 * a YAML parser. The handoff service (`src/services/prd/handoff-service.ts`)
 * is the canonical writer; we only consume its output here.
 */
export declare function readAndVerifyHandoff(handoffPath: string, projectRoot: string): {
    frontmatter: HandoffFrontmatter;
    body: string;
} | null;
/**
 * Read the project-level security-template.md. Returns the body
 * string (with frontmatter stripped) or null if the file is absent.
 * Does NOT validate the template content; the parent LLM validates
 * by reading.
 */
export declare function readSecurityTemplate(projectRoot: string): string | null;
/** The verified handoff's sha256, or `unknown` when there is no capsule. */
export declare function resolveHandoffHash(projectRoot: string, sessionId: string, rid: string): string;