import type { Layer2Manifest, Layer2Component, IntegrityCheckResult } from './types.js';
export declare class Layer2Guardian {
    private projectRoot;
    private manifestPath;
    private manifest;
    private componentPaths;
    constructor(projectRoot: string, opts?: {
        manifestPath?: string;
        componentPaths?: {
            component: Layer2Component;
            path: string;
        }[];
    });
    /**
     * Validate that a modification proposal does not target Layer 2.
     * This is the first line of defense: structural prevention at the type level.
     */
    validateProposal(proposal: {
        safety: {
            modifies_layer2: boolean;
            modifies_approval_framework: boolean;
        };
        payload: unknown;
    }): {
        valid: boolean;
        reason: string;
    };
    /**
     * Verify that Layer 2 files have appropriate permissions.
     * In production, Layer 2 files should be owned by a different user
     * and be read-only from the agent's perspective.
     */
    verifyPermissions(): Promise<{
        valid: boolean;
        findings: {
            path: string;
            issue: string;
        }[];
    }>;
    /**
     * Generate a Layer 2 manifest by hashing all component files.
     * This is called during deployment (by humans), not at runtime (by agents).
     */
    generateManifest(deployedBy: string): Promise<Layer2Manifest>;
    /**
     * Save the manifest to disk.
     */
    saveManifest(manifest?: Layer2Manifest): Promise<void>;
    /**
     * Load the manifest from disk.
     */
    loadManifest(): Promise<Layer2Manifest | null>;
    /**
     * Verify Layer 2 integrity by comparing current file hashes
     * against the signed manifest. Called at system startup.
     *
     * If ANY component has been modified, returns a violation.
     * The caller MUST halt the system on violation.
     */
    verifyIntegrity(): Promise<IntegrityCheckResult>;
    /**
     * Run all four levels of verification.
     * Returns a comprehensive status report.
     */
    fullAudit(): Promise<{
        permissions: {
            valid: boolean;
            findings: {
                path: string;
                issue: string;
            }[];
        };
        integrity: IntegrityCheckResult;
        manifestPresent: boolean;
        overallSafe: boolean;
    }>;
    /**
     * Get the current manifest (if loaded).
     */
    getManifest(): Layer2Manifest | null;
}