/**
 * ReviewExchange — the autonomous code-review protocol (spec §7 G2.3).
 *
 * A ReviewExchange is one mutual, mandate-gated sign-off of a review artifact
 * between the two agents named in a Coordination Mandate. It is how Phase-1's
 * "code-owner review" happens WITHOUT the human relaying: the owner agent delivers
 * a review package over Threadline, the peer reviews and returns an authenticated
 * verdict, and BOTH sign-offs are checked against the mandate's `sign-code-review`
 * authority (bounds e.g. `{ artifact: 'migration-port', mutual: true }`) before
 * they are accepted. Every accepted signature carries the audit hash of the gate
 * decision that authorized it — the trail Justin reviews.
 *
 * Asymmetry, stated honestly: the peer's instance may not run this engine yet, so
 * the peer's "signature" is their authenticated Threadline verdict message
 * (Ed25519-authenticated sender → fingerprint), recorded verbatim by reference —
 * kind 'authenticated-peer-verdict'. The local agent's signature goes through the
 * local gate — kind 'mandate-gated-local'. BOTH are gate-evaluated here (named
 * party, bounds, expiry, revocation), so a stranger's verdict or an out-of-bounds
 * artifact is refused identically.
 *
 * State machine (linear, no skips):
 *   proposed → delivered → verdict-recorded → complete
 *                      ↘ changes-requested (terminal: rework = a NEW exchange)
 *
 * The review package is content-addressed: `packageSha256` is fixed at creation
 * and signatures bind to the record that carries it — a different package is a
 * different exchange. Deny-by-default is inherited: with no mandate issued, every
 * sign/verdict path denies.
 */
import type { MandateGate } from './MandateGate.js';
export type ReviewExchangeState = 'proposed' | 'delivered' | 'verdict-recorded' | 'complete' | 'changes-requested';
export interface ReviewSignature {
    /** The signing agent's routing fingerprint (a named party of the mandate). */
    agentFp: string;
    signedAt: string;
    /** 'mandate-gated-local' = this server's own agent, allowed by the local gate;
     *  'authenticated-peer-verdict' = the peer's sign-off, carried by their
     *  authenticated Threadline verdict message (recorded by reference). */
    kind: 'mandate-gated-local' | 'authenticated-peer-verdict';
    /** Hash of the audit entry for the gate decision that authorized this signature. */
    auditHash: string;
    /** Evidence reference — e.g. a Threadline message/thread ref for peer signatures. */
    evidence: string | null;
}
export interface PeerVerdict {
    verdict: 'approve' | 'request-changes';
    summary: string;
    /** Authenticated-source reference (Threadline message/thread id). */
    evidence: string;
    recordedAt: string;
}
export interface ReviewExchangeRecord {
    id: string;
    /** The mandate whose `sign-code-review` authority governs this exchange. */
    mandateId: string;
    /** The artifact under review — must match the authority's bounds (e.g. 'migration-port'). */
    artifact: string;
    /** Human-readable pointer to the review package (repo path or URL). */
    packageRef: string;
    /** sha256 of the package content — what the signatures bind to. Immutable. */
    packageSha256: string;
    /** [ownerFp, peerFp] — owner delivers, peer reviews. Both must be mandate parties. */
    parties: [string, string];
    state: ReviewExchangeState;
    /** Delivery evidence (e.g. Threadline message id), set by markDelivered. */
    deliveredEvidence: string | null;
    peerVerdict: PeerVerdict | null;
    signatures: ReviewSignature[];
    createdAt: string;
    updatedAt: string;
}
/** Uniform method result — gate denials and state errors come back as data, not throws. */
export type ExchangeResult = {
    ok: true;
    record: ReviewExchangeRecord;
} | {
    ok: false;
    reason: string;
};
export interface ReviewExchangeEngineDeps {
    /** Absolute path to the exchanges JSON file. */
    filePath: string;
    /** The mandate gate — EVERY sign-off is evaluated through it. */
    gate: MandateGate;
    now?: () => number;
    /** Exchange id generator (default: random). Injected for deterministic tests. */
    genId?: () => string;
}
export interface CreateExchangeInput {
    mandateId: string;
    artifact: string;
    packageRef: string;
    packageSha256: string;
    parties: [string, string];
    id?: string;
}
export declare class ReviewExchangeEngine {
    private readonly d;
    constructor(deps: ReviewExchangeEngineDeps);
    private nowIso;
    private readAll;
    private writeAll;
    private save;
    /** Evaluate `sign-code-review` for one party through the mandate gate. */
    private gateSignOff;
    /** Create a new exchange in `proposed`. Validation only — no gate call yet
     *  (creating a record delegates nothing; the sign-offs are what the mandate governs). */
    create(input: CreateExchangeInput): ExchangeResult;
    /** proposed → delivered. Records the delivery evidence (Threadline message ref). */
    markDelivered(id: string, evidence: string): ExchangeResult;
    /**
     * delivered → verdict-recorded | changes-requested.
     *
     * Records the PEER's authenticated verdict. An 'approve' verdict IS the peer's
     * sign-off, so it is MANDATE-GATED for the peer's fingerprint (named party,
     * bounds, expiry, revocation — a deny refuses the verdict). A 'request-changes'
     * verdict delegates nothing (it is a refusal), so it is recorded ungated — but
     * only from the exchange's named peer.
     */
    recordPeerVerdict(id: string, input: {
        verdict: 'approve' | 'request-changes';
        summary: string;
        evidence: string;
        peerFp: string;
    }): ExchangeResult;
    /**
     * verdict-recorded → complete. The OWNER's countersignature, mandate-gated for
     * the owner's fingerprint. Completion requires the mutual pair: the peer's
     * approve-signature already present + this one.
     */
    sign(id: string, agentFp: string): ExchangeResult;
    get(id: string): ReviewExchangeRecord | undefined;
    list(): ReviewExchangeRecord[];
}
//# sourceMappingURL=ReviewExchange.d.ts.map