/**
 * Shared utilities for IDE adapters.
 *
 * User-identity resolution, canonical audit-event builders, session-handle
 * generation. These live exactly once here; every IDE adapter imports what
 * it needs rather than reimplementing.
 *
 * Spec: P3-IDE-01 Section 3.4, Section 3.2
 *
 * @connexum/ai-governance
 */
import type { UserIdentity, IdeAuditEventType, IdeSessionHandle } from './index';
/**
 * Generate a collision-resistant session handle for an IDE adapter session.
 * Format: <ideId>-<8-hex-random>-<unix-ms>
 */
export declare function generateSessionHandle(ideId: string): IdeSessionHandle;
/**
 * Attempt to read user identity from the `.claude/session.json` file.
 * Returns the userId string if found, or null if the file is absent or
 * does not contain a resolvable userId field.
 *
 * This is a best-effort read. Throws are caught and converted to null so
 * the caller decides how to fail.
 */
export declare function readClaudeSessionFile(sessionFilePath?: string): string | null;
/**
 * Resolve a `UserIdentity` for the Claude Code adapter.
 *
 * Resolution order:
 *   1. `CLAUDE_SESSION_USER` environment variable
 *   2. `.claude/session.json` userId field
 *   3. Throws `IdeAttributionError` (fail-closed per Thomas philosophy)
 *
 * Anonymous sessions are permitted ONLY when `allowAnonymousIdeSessions`
 * is explicitly true in the adapter config. Otherwise this always throws
 * on failure to resolve.
 *
 * @param sessionFilePath - Override path to session.json (for tests)
 * @param allowAnonymous - Must be explicitly true to allow anonymous sessions
 */
export declare function resolveClaudeCodeUserIdentity(sessionFilePath?: string, allowAnonymous?: boolean): UserIdentity;
export interface IdeAuditEvent {
    type: IdeAuditEventType;
    severity: 'DEBUG' | 'INFO' | 'WARN' | 'CRITICAL';
    ideId: string;
    adapterId: string;
    sessionId?: string;
    initiatingUserId?: string;
    tool?: string;
    detail: string;
    timestamp: string;
    data?: Record<string, unknown>;
}
export type IdeAuditEmitter = (event: IdeAuditEvent) => void;
/**
 * Build a canonical IDE audit event with all required fields.
 * Severity is inferred from the event type per the taxonomy table.
 */
export declare function buildIdeAuditEvent(type: IdeAuditEventType, opts: {
    ideId: string;
    adapterId: string;
    sessionId?: string;
    initiatingUserId?: string;
    tool?: string;
    detail: string;
    data?: Record<string, unknown>;
}): IdeAuditEvent;
export declare const SHARED_DESTRUCTIVE_PATTERNS: RegExp[];
export declare const SHARED_SENSITIVE_PATH_PATTERNS: RegExp[];
/**
 * C6 fix: split a shell command string on the common separator tokens so
 * that each sub-command is scanned independently for destructive patterns.
 *
 * Without this, a chained command like "echo safe; rm -rf /" evades
 * detection because the full string does not match any single pattern --
 * only the sub-command after the semicolon does.
 *
 * Separators covered:
 *   ;    sequential execution
 *   &&   conditional-AND
 *   ||   conditional-OR
 *   $(   command substitution (inner command runs first)
 *   `    backtick command substitution
 */
export declare function splitOnShellSeparators(command: string): string[];
/**
 * Returns true if the command string -- or any of its shell-separated
 * sub-commands -- matches any destructive pattern.
 *
 * Used by CursorIdeAdapter (filesystem-sidecar mode) and ContinueDevIdeAdapter.
 */
export declare function isDestructiveCommand(command: string, extraPatterns?: RegExp[]): {
    matched: boolean;
    pattern?: RegExp;
    segment?: string;
};
/**
 * Returns true if the file path matches any sensitive-path pattern.
 * Used by CursorIdeAdapter and ContinueDevIdeAdapter.
 */
export declare function isSensitivePath(filePath: string, extraPatterns?: RegExp[]): {
    matched: boolean;
    pattern?: RegExp;
};
export interface SecretScanFinding {
    line: number;
    pattern: string;
    excerpt: string;
}
/**
 * Scan a unified diff string for added lines containing secret patterns.
 * Returns an array of findings. Empty array means no findings.
 */
export declare function scanDiffForSecrets(diff: string): SecretScanFinding[];
//# sourceMappingURL=shared.d.ts.map