/**
 * 运行安全包 — 证据 hash chain、命令副作用分级、供应链治理、迁移回滚契约。
 * advisory: 不 hard block（除 destructive 命令需人工确认）。
 */
export interface EvidenceBlock {
    step: string;
    timestamp: string;
    data_hash: string;
    prev_hash: string | null;
    chain_hash: string;
    payload: string;
}
/**
 * 构建证据链 — 每个步骤产出带 hash 的证据块，与前一个块链式连接。
 */
export declare function buildEvidenceChain(steps: Array<{
    step: string;
    payload: string;
    timestamp?: string;
}>): EvidenceBlock[];
/**
 * 验证证据链完整性 — 检查每个块的 chain_hash 是否与重算结果一致。
 */
export declare function verifyEvidenceChain(chain: EvidenceBlock[]): {
    valid: boolean;
    broken_at: number | null;
    advisory: string;
};
export type CommandRisk = "read_only" | "mutating" | "destructive";
export interface ClassifiedCommand {
    command: string;
    risk: CommandRisk;
    advisory: string;
    requires_human_confirm: boolean;
}
/**
 * 分类命令的副作用级别。
 */
export declare function classifyCommand(command: string): ClassifiedCommand;
export interface MigrationContract {
    migration_id: string;
    description: string;
    forward_command: string;
    rollback_command: string;
    risk: CommandRisk;
    created_at: string;
}
export interface MigrationCheckResult {
    migration_id: string;
    has_rollback: boolean;
    rollback_valid: boolean;
    advisory: string;
}
/**
 * 检查迁移契约 — 确保 schema 变更有回滚路径。
 */
export declare function checkMigrationContract(migration: MigrationContract): MigrationCheckResult;
export interface DependencyCheck {
    package_name: string;
    version: string;
    has_lockfile: boolean;
    has_integrity_hash: boolean;
    advisory: string;
}
export interface SupplyChainReport {
    total_dependencies: number;
    locked_dependencies: number;
    unlocked_dependencies: number;
    checks: DependencyCheck[];
    advisory: string;
}
/**
 * 检查供应链安全 — 验证依赖有 lockfile 和完整性 hash。
 * 此为轻量级检查，不读取实际文件内容。
 */
export declare function checkSupplyChain(rootDirFiles: string[], dependencies: Array<{
    name: string;
    version: string;
}>): SupplyChainReport;
//# sourceMappingURL=runtime_safety.d.ts.map