/**
 * Codemod handler — PR-5a-2
 *
 * Real codemod execution using ts-morph (TS/JS) and a sandboxed string
 * transform (Python). Replaces the PR-5a-1 stub that returned 'skipped'.
 *
 * Execution model:
 *   1. Glob the agent directory for files matching payload.fileGlob.
 *   2. For each matched file, load its source.
 *   3. Wrap the embedded transformSource in a CJS module wrapper.
 *   4. Execute in vm.runInNewContext() via runInSandbox() with the
 *      restricted allowlist (ts-morph, path, fs/read-only).
 *   5. The transform function receives the file source and a helpers object.
 *      For TS/JS: it may use ts-morph via require('ts-morph').
 *      For Python: the transform returns the mutated source string.
 *   6. If the transform writes via helpers.writeFile(), those writes land in
 *      SandboxResult.pendingWrites and are flushed to disk (in non-dry-run mode).
 *   7. The handler captures before/after diffs and returns a RemediationResult.
 *
 * Security model (Shield H-3):
 *   - transformSource is an embedded string, NOT a file path reference.
 *   - Signature is verified before execution (UNSIGNED only in test fixtures).
 *   - vm.runInNewContext() with timeout; deny-list enforced by restrictedRequire.
 *   - Write access goes through helpers.writeFile — raw fs.writeFile is not
 *     exposed to the transform.
 *
 * @connexum/ai-governance PR-5a-2
 */
import { CodemodPayload, RemediationResult, PackRemediation } from '../types';
/**
 * Apply a codemod remediation to an agent directory.
 *
 * The transform function signature (embedded in payload.transformSource):
 *
 *   For TS/JS:
 *     module.exports.transform = async function(sourceCode, helpers) {
 *       // use helpers.writeFile(relPath, newContent) to write output
 *       // use require('ts-morph') for AST manipulation
 *     }
 *
 *   For Python:
 *     module.exports.transform = function(sourceCode, helpers) {
 *       // return the transformed source string
 *     }
 *
 * The handler calls transform(fileSource, helpers) for each matched file.
 * If the transform calls helpers.writeFile(), those writes are persisted.
 * If the transform returns a string, it is treated as the mutated source
 * and written to the original file path.
 */
export declare function applyCodemod(agentDir: string, remediation: PackRemediation, payload: CodemodPayload, packId: string, packVersion: string): Promise<RemediationResult>;
//# sourceMappingURL=codemod.d.ts.map