/**
 * `dxkit baseline create` orchestrator.
 *
 * Builds the shared producer context (runs every analyzer once),
 * dispatches through the canonical producer registry (CLAUDE.md
 * Rule 10), captures repo + analysis-environment metadata, and
 * writes the result to `.dxkit/baselines/<name>.json`. The on-disk
 * file is the durable record subsequent `guardrail check` runs diff
 * against.
 *
 * This module is the producer side; the matcher + classifier on the
 * consumer side already exist in `git-aware-match.ts` and
 * `policy.ts`. The two are connected by the file format defined in
 * `baseline-file.ts`.
 *
 * Per-kind producer coverage + deferral rationale live in the
 * registry index (`./producers/index.ts`) — the single discovery
 * surface. Adding a new identity kind or analyzer means
 * registering a producer there, never an edit here.
 */
import type { ScanCoverage } from './coverage';
import type { BaselineAnalysisMeta, BaselineFile, BaselineRepoState } from './baseline-file';
import type { ResolvedMode } from './modes';
import type { ProducerContext } from './producers';
import type { SaltMode } from './salt';
import type { RichBaselineEntry } from './types';
import type { SecurityAggregate } from '../analyzers/security/aggregator';
export interface CreateBaselineOptions {
    /** Repo root to baseline. Caller should pass an absolute path. */
    readonly cwd: string;
    /** Baseline name (becomes the filename stem under `.dxkit/baselines/`).
     *  Defaults to `'main'`. Different names allow per-branch / per-
     *  environment baselines to coexist on disk. */
    readonly name?: string;
    /** When true, overwrite an existing baseline file at the same path.
     *  When false (default), an existing file makes `createBaseline`
     *  throw — guards against accidentally clobbering a committed
     *  baseline with a fresh capture. */
    readonly force?: boolean;
    /** Forwarded to the underlying analyzer for per-tool timing logs. */
    readonly verbose?: boolean;
    /** Pre-resolved baseline mode. When supplied, the orchestrator
     *  skips its own resolution + policy load. Callers wanting
     *  deterministic behavior (tests, agents) pass this. */
    readonly resolvedMode?: ResolvedMode;
    /** Explicit CLI flag value for the mode (`--mode=<X>`). Forwarded
     *  to `resolveBaselineMode`. Ignored when `resolvedMode` is
     *  supplied. */
    readonly cliMode?: ResolvedMode['mode'];
    /** Explicit CLI flag value for the ref (`--ref=<R>`). Only
     *  consulted when the resolved mode is `ref-based`. */
    readonly cliRef?: string;
}
/** Outcome of `createBaseline`. `path` and `file` are absent when
 *  mode resolved to `ref-based` — no file is written, and the
 *  `mode` field carries the audit trail so callers can surface
 *  WHY nothing landed on disk. */
export interface CreateBaselineResult {
    readonly mode: ResolvedMode;
    readonly path?: string;
    readonly file?: BaselineFile;
}
/**
 * Test seam: clear the version cache between test runs so per-test
 * fixtures don't leak resolutions into one another. Production
 * callers never use this — the cache lives for the entire CLI
 * invocation and dies with the process.
 */
export declare function clearToolVersionCache(): void;
/**
 * Snapshot of one analyzer run, in the exact shape the baseline file
 * and the guardrail-check both need. Built by `gatherCurrentScan`
 * once and consumed by either path.
 *
 * Why this is shared: the guardrail check re-runs every analyzer to
 * produce the "current" side of the diff. Without a shared step, the
 * gather + producer-dispatch logic would have to be duplicated in
 * `check.ts` — exactly the class of duplication CLAUDE.md Rule 2
 * forbids for tool invocation, and the same hazard applies here.
 */
export interface CurrentScan {
    readonly findings: ReadonlyArray<RichBaselineEntry>;
    readonly aggregate: SecurityAggregate;
    readonly repoState: BaselineRepoState;
    readonly saltMode: SaltMode;
    /** Per-tool name → version map for the run that just completed. */
    readonly tools: Readonly<Record<string, string>>;
    /** Scanner availability snapshot for the run — which finding-
     *  contributing tools were detected vs missing on this machine. */
    readonly coverage: ScanCoverage;
    /** Envelope metadata for the run. `toolchainHash` is already
     *  resolved from `tools`. */
    readonly analysisMeta: BaselineAnalysisMeta;
    /** Echoed back so the guardrail check can attribute per-pair
     *  severity, overlap, and reachable signals without re-gathering. */
    readonly producerCtx: ProducerContext;
}
/**
 * Run every analyzer once, dispatch through the producer registry,
 * and return the assembled `CurrentScan`. Used by `createBaseline`
 * to capture today's state and by `runGuardrailCheck` to gather the
 * current side of the cross-run diff.
 *
 * Pure-orchestrator: each step has a single responsibility (analyze
 * → produce entries → resolve envelope metadata).
 */
export declare function gatherCurrentScan(options: {
    readonly cwd: string;
    readonly verbose?: boolean;
}): Promise<CurrentScan>;
/**
 * Scanner-availability snapshot for `cwd`, independent of a full scan.
 *
 * Cheap pre-flight used by the CLI to warn — before paying for the
 * gather — when finding-contributing scanners are missing on this
 * machine, so a developer isn't surprised by a silently-incomplete
 * baseline. Detects the stack and probes each required tool.
 */
export declare function gatherScanCoverage(cwd: string): ScanCoverage;
/**
 * Run the baseline-create pipeline. Pure-orchestrator: resolve
 * the baseline mode, gather the current scan, then either:
 *
 *   - `committed-full` → write rich entries to disk (today's
 *     behavior).
 *   - `committed-sanitized` → sanitize every entry, then write.
 *     The cross-run matching contract is preserved; locator
 *     fields are stripped.
 *   - `ref-based` → no file write. The guardrail check will
 *     recompute the prior side from a git ref instead.
 *
 * In all three cases the returned `CreateBaselineResult` carries
 * `resolvedMode` so callers can log WHY a given mode was picked
 * (CLI flag / policy file / visibility auto-detect).
 */
export declare function createBaseline(options: CreateBaselineOptions): Promise<CreateBaselineResult>;
//# sourceMappingURL=create.d.ts.map