/**
 * Shared peer-fingerprint resolution for Threadline local attribution.
 *
 * The anti-hijack guard compares an inbound sender's identity against the
 * thread owner. The owner is RECORDED (captureOrigin / recordSent) by the
 * derivation `fingerprint || publicKey[:32] || name`. The inbound COMPARE side
 * must derive the same way, or a legitimate reply mismatches and is isolated.
 * Both sides funnel through this one module so record and compare can never
 * diverge.
 *
 * Convergence keystone: the live known-agents.json records some peers (e.g.
 * sagemind) with NO `fingerprint` field — only a `publicKey` — so the owner was
 * recorded as `publicKey[:32]`. A resolver reading only `fingerprint` returns
 * null and the fix no-ops on the exact incident. The chain below is identical to
 * the record-site chain (minus the final `|| name`, which the record site keeps).
 *
 * Spec: docs/specs/threadline-local-delivery-fingerprint-attribution.md
 */
interface KnownAgentLike {
    name?: string;
    publicKey?: string;
    fingerprint?: string;
}
/**
 * Derive a peer's canonical routing fingerprint from a known-agents entry:
 * `fingerprint`, else first-32 chars of `publicKey`, else null. Lowercased.
 * Mirrors the owner-record derivation (sans the record site's `|| name` fallback).
 */
export declare function resolvePeerFingerprint(entry: KnownAgentLike | null | undefined): string | null;
/**
 * Resolve a peer NAME → canonical fingerprint via
 * `{stateDir}/threadline/known-agents.json`.
 *
 * Returns null when: the file is missing/unreadable/oversized/malformed, the
 * name is absent, the matching entry has neither `fingerprint` nor `publicKey`,
 * OR multiple entries match the name with DIFFERENT derived fingerprints
 * (collision → never guess; cf. #1032). Never throws.
 */
export declare function resolvePeerFingerprintByName(stateDir: string, name: string | null | undefined): string | null;
export {};
//# sourceMappingURL=peerFingerprint.d.ts.map