/**
 * Detect references to downstream host projects in this repository's own files.
 *
 * Projects may mention Lisa; Lisa may not mention projects. This repository is
 * public and `dist/` is in the npm `files` allowlist, so a comment in `src/` is
 * published twice — on github.com and to every consumer that installs.
 *
 * **Two detectors, because one shape was never the whole problem.**
 *
 * The first is shape detection: allowlist the orgs that are legitimately
 * public, flag every other `github.com/owner/repo` or workflow `uses:`, and a
 * newly onboarded downstream project is caught without anyone remembering to
 * add it. That reach is real and it is kept.
 *
 * The second is a known-name check, added because the first measured zero
 * violations on a tree that had them. Every occurrence that actually happens is
 * a bare name in prose, in a code comment, or inside a local absolute path —
 * no `github.com` in front of it, and frequently no slash in it at all. Shape
 * detection cannot reach that without matching bare `a/b` everywhere, which
 * collides with file paths, date fractions and option syntax; a guard with
 * false positives gets disabled, which is worse than a known blind spot. A
 * fixed list has no false-positive problem to trade against, and the objection
 * to a list — that it publishes the names — is answered by storing digests
 * rather than names. See `./downstream-names.js`.
 * @module core/downstream-references
 */
import type { NameMatcher } from "./downstream-names.js";
/**
 * GitHub orgs this repository may legitimately name.
 *
 * Lisa's own org, the platforms it integrates with, and the vendors whose
 * actions and packages it pins. Anything outside this set is treated as a host
 * project until someone deliberately says otherwise.
 */
export declare const PUBLIC_ORGS: readonly string[];
/**
 * Owners that are obviously stand-ins rather than real accounts.
 *
 * Documentation needs a worked example, and refusing one would push authors
 * toward using a real name instead — the opposite of the intent.
 */
export declare const PLACEHOLDER_OWNERS: readonly string[];
/**
 * AWS account ids that are documentation placeholders rather than real ones.
 *
 * AWS's own docs use `123456789012`; the repeated-digit forms are unmistakably
 * synthetic. Any other 12-digit account id in an ARN is treated as real.
 */
export declare const PLACEHOLDER_ACCOUNTS: readonly string[];
/** One detected reference, with enough context to act on it. */
export interface DownstreamReference {
    /** 1-indexed line number. */
    readonly line: number;
    /** What was matched. */
    readonly match: string;
    /** Why it is a violation. */
    readonly reason: string;
}
/**
 * Find downstream-project references in one file's contents.
 * @param contents - The file's text.
 * @param matcher - Name matcher to use; defaults to the committed list plus
 *   anything the environment adds.
 * @returns Every violation found, in line order.
 */
export declare function findDownstreamReferences(contents: string, matcher?: NameMatcher): readonly DownstreamReference[];
//# sourceMappingURL=downstream-references.d.ts.map