/**
 * Pack-content hash computation — Layer 3 of the third-party pack rejection defence.
 *
 * F-NEW-PACK-CONTENT-HASH-BINDING-2026-05-24
 *
 * Computes a SHA-256 hash over the enforcement-relevant fields of a
 * CompliancePack. The hash is embedded in each pack at build time
 * (scripts/compute-pack-content-hashes.mjs) and re-verified at runtime
 * inside createGovernedAgent() and on the server in /check-action.
 *
 * --- CANONICAL FORM ---
 * Only the fields that determine how the pack enforces rules are included.
 * Runtime-only state (contentHash itself, aliases, categoryClassifiers,
 * remediations, pii_shield, etc.) is excluded so the hash is stable across
 * build environments and backward-compatible when new optional fields are added.
 *
 * Canonical object shape (order matters for JSON.stringify stability):
 *   {
 *     id: string,
 *     name: string,
 *     version: string,
 *     description: string,
 *     requiredModules: PackModule[] (sorted ascending by name, each field sorted),
 *     validators:      PackValidator[] (sorted ascending by id, each field sorted),
 *   }
 *
 * @connexum/ai-governance
 */
import type { CompliancePack } from './index.js';
/**
 * Build the canonical object that is serialised and hashed.
 * Excludes contentHash and all non-enforcement fields so the hash is
 * self-consistent and build-environment-independent.
 */
export declare function buildCanonicalPackContent(pack: CompliancePack): Record<string, unknown>;
/**
 * Compute the SHA-256 content hash for a compliance pack.
 *
 * The hash is deterministic given the same pack content. It is NOT
 * keyed (no HMAC secret) — the trust model is that the registry
 * is built and distributed by Connexum; an attacker who can modify the
 * registry binary can also modify the hash. The protection is against
 * runtime monkey-patching AFTER the module is loaded (e.g. patching
 * validators[] in-memory before createGovernedAgent() is called).
 */
export declare function computePackContentHash(pack: CompliancePack): string;
//# sourceMappingURL=pack-content-hash.d.ts.map