import { type ProjectReadBoundary } from "../io/bootstrap-write-boundary.js";
import { type GitIdentity } from "./ci-reverification-identity.js";
import { type SourceIdentityEntry } from "./source-identity.js";
import type { SourceIdentity } from "./source-identity-types.js";
export declare function captureProjectFinishAttestationSourceIdentity(projectDir: string, git: GitIdentity, projectReadBoundary?: ProjectReadBoundary): {
    readonly diagnosticCode: string;
    readonly status: "unavailable";
} | {
    readonly status: "available";
    readonly value: SourceIdentity;
};
export declare function captureProjectFinishAttestationSourceEntries(projectDir: string, git: GitIdentity, projectReadBoundary?: ProjectReadBoundary): {
    readonly diagnosticCode: string;
    readonly status: "unavailable";
} | {
    readonly status: "available";
    readonly value: readonly SourceIdentityEntry[];
};
export declare function matchesProjectFinishAttestationSource(projectDir: string, expected: SourceIdentity, suppliedBoundary?: ProjectReadBoundary): boolean;
/**
 * Where the current source stopped matching the signed identity, or `undefined`
 * when it matches.
 *
 * `source-drift` alone sends a reader looking for a change that git often
 * insists is not there. The case that costs the most time: git normalizes line
 * endings, so a checkout can report `git status --porcelain
 * --untracked-files=all` with zero entries while a file's working-tree bytes
 * differ from the bytes that were committed and signed. Head matches, entry
 * counts match, the git status digest matches, and only the content digest
 * moves — with nothing in the diagnostic pointing at why.
 *
 * The tracked index digest separates that case cleanly only when there are no
 * untracked entries. With an untracked file present, its contents can change
 * while both the status and tracked-index digests remain the same, so the
 * diagnostic must stay at the content-drift level.
 *
 * Reporting only; no verdict changes. Any drift still blocks.
 */
export declare function projectFinishAttestationSourceDriftPath(projectDir: string, expected: SourceIdentity, suppliedBoundary?: ProjectReadBoundary): string | undefined;
export declare function sourceIdentityDriftPath(actual: SourceIdentity, expected: SourceIdentity): string;