/**
 * `dxkit guardrail check` orchestrator.
 *
 * The matcher (`gitAwareMatch`) and classifier (`classify`) are pure
 * modules that already exist. This file wires them together with the
 * baseline file format, the producer pipeline, and the per-pair
 * context lookups (severity, drift signals, changed-line overlap)
 * the classifier needs to make policy decisions.
 *
 * Pipeline:
 *
 *   1. Load the prior baseline file.
 *   2. Re-run every analyzer (via `gatherCurrentScan`) to produce the
 *      current side of the diff.
 *   3. Convert both sides to `LocatedIdentity[]` and run the
 *      git-aware matcher.
 *   4. Build per-pair classify context:
 *        - severity from the current security aggregate or per-kind
 *          defaults
 *        - kind from the matched BaselineEntry
 *        - scannerVersionDiffers from per-kind tool version compare
 *        - configDiffers from envelope hash compare
 *        - overlapsChangedLines from `git diff base..HEAD` hunks
 *          intersected with the finding's line
 *   5. Run the brownfield policy classifier over every pair.
 *   6. Optionally filter via `--changed-only`: drop pairs whose
 *      locator falls outside the diff. Non-locator pairs (dep-vuln,
 *      duplication, etc.) are always kept — their "semantic"
 *      identity doesn't map cleanly to changed lines.
 *   7. Compose a `GuardrailCheckResult` with a deterministic
 *      blocks/warns verdict so the CLI can pick exit code + render.
 *
 * Drift signals come from comparing the baseline's `analysis` /
 * `tools` envelope against the freshly-gathered envelope. Per-kind
 * tool attribution uses the current run's `SecurityAggregate.provenance`
 * — the cleaner alternative to a hardcoded kind→tool table.
 */
import type { CurrentScan } from './create';
import type { BaselineFile } from './baseline-file';
import type { CoverageDrift } from './coverage';
import type { ResolvedMode } from './modes';
import type { BrownfieldPolicy, ClassifyResult } from './policy';
import type { BaselineEntry, FindingSeverity, MatchPair, MatchResult } from './types';
import { type AllowlistDelta } from '../allowlist/diff';
export interface RunGuardrailCheckOptions {
    /** Repo root being checked. Caller should pass an absolute path. */
    readonly cwd: string;
    /** Baseline name to read from `.dxkit/baselines/<name>.json`.
     *  Defaults to `'main'`. */
    readonly name?: string;
    /** Explicit baseline file path. Overrides `name` when supplied —
     *  lets callers diff against a baseline stored outside the default
     *  directory (e.g. an artifact downloaded from CI). */
    readonly baselinePath?: string;
    /** When true, drop pairs whose locator falls outside the diff.
     *  Non-locator findings (dep-vuln, duplication, etc.) are always
     *  kept. */
    readonly changedOnly?: boolean;
    /** Path to a `.dxkit/policy.json` override. The on-disk shape
     *  matches `BrownfieldPolicy` (modulo readonly markers); unknown
     *  fields are preserved but not type-checked here — the policy
     *  classifier reads only the fields it knows. When omitted, a
     *  `<cwd>/.dxkit/policy.json` is auto-loaded if it exists; otherwise
     *  the compiled-in defaults apply. */
    readonly policyPath?: string;
    /** Forwarded to the underlying analyzers for per-tool timing logs. */
    readonly verbose?: boolean;
    /** Pre-resolved baseline mode. When supplied, the orchestrator
     *  skips its own resolution. Callers wanting deterministic
     *  behavior (tests, agents) pass this. */
    readonly resolvedMode?: ResolvedMode;
    /** Explicit CLI flag value for the mode (`--mode=<X>`). Forwarded
     *  to `resolveBaselineMode`. Ignored when `resolvedMode` is
     *  supplied. */
    readonly cliMode?: ResolvedMode['mode'];
    /** Explicit CLI flag value for the ref (`--ref=<R>`). Only
     *  consulted when the resolved mode is `ref-based`. */
    readonly cliRef?: string;
}
/**
 * Per-pair entry the CLI renderers consume. Carries the raw
 * `MatchPair`, the classifier verdict, and enough context to render
 * a meaningful diagnostic (which side the entry lives on, kind,
 * severity, file/line locator).
 */
export interface ClassifiedPair {
    readonly pair: MatchPair;
    readonly classification: ClassifyResult;
    /** Resolved severity (or undefined when the pair has no current-
     *  side entry to attribute to — `removed` pairs typically). */
    readonly severity?: FindingSeverity;
    /** Kind of the pair's anchor entry (prior for `removed`, current
     *  for everything else). */
    readonly kind: BaselineEntry['kind'];
    /** Locator info for renderers — populated when the anchor entry
     *  carries `file` / `line`. */
    readonly file?: string;
    readonly line?: number;
    /** True when the anchor entry's line falls inside the diff
     *  between baseline and HEAD. Undefined when the pair has no
     *  line locator (dep-vuln, etc.) or when git history isn't
     *  reachable. Drives `--changed-only` filtering and the
     *  `newSevereQualityIssueInChangedFiles` / `newUntestedChangedSource`
     *  block rules. */
    readonly overlapsChangedLines?: boolean;
}
export interface EnvelopeDrift {
    readonly toolchainHashChanged: boolean;
    readonly policyHashChanged: boolean;
    readonly ignoreHashChanged: boolean;
    readonly configHashChanged: boolean;
    readonly dxkitVersionChanged: boolean;
    /** Per-tool version drift. Empty when `tools` maps agree. */
    readonly toolVersionDiffs: ReadonlyArray<{
        readonly tool: string;
        readonly baselineVersion: string | undefined;
        readonly currentVersion: string | undefined;
    }>;
    /** Scanners whose availability flipped between baseline capture and
     *  this check. A tool missing at baseline but present now means the
     *  baseline never covered that category — its findings surface as new
     *  rather than pre-existing. Empty when coverage agrees (or when the
     *  baseline predates the coverage record). */
    readonly coverageDrift: ReadonlyArray<CoverageDrift>;
}
export interface GuardrailCheckResult {
    /** Pre-resolved baseline mode (which path produced `baseline`).
     *  Carries the audit trail (CLI / policy / auto-detect) so the
     *  CLI surface can log WHY the mode was picked. */
    readonly mode: ResolvedMode;
    /** On-disk path of the baseline file, or undefined when mode is
     *  `ref-based` (the prior side was computed from a git ref, not
     *  read from a committed file). */
    readonly baselinePath?: string;
    readonly baseline: BaselineFile;
    readonly current: CurrentScan;
    readonly matchResult: MatchResult;
    readonly pairs: ReadonlyArray<ClassifiedPair>;
    readonly envelopeDrift: EnvelopeDrift;
    readonly policy: BrownfieldPolicy;
    /** True when at least one classified pair blocks. The CLI maps
     *  this to exit code 1. */
    readonly blocks: boolean;
    /** True when at least one pair warns. Informational; doesn't
     *  affect exit code by itself. */
    readonly warns: boolean;
    /** Allowlist entries added / removed between the baseline's
     *  commit SHA and the current working tree. Renderers (the PR
     *  comment markdown in particular) surface this so reviewers
     *  see new suppressions being introduced. Absent when the
     *  baseline SHA wasn't reachable to diff against. */
    readonly allowlistDelta: AllowlistDelta;
}
/**
 * Run the guardrail-check pipeline. Pure-orchestrator: loads the
 * baseline, gathers current state, runs the matcher + classifier,
 * and returns a structured result. Renderers + CLI are downstream.
 */
export declare function runGuardrailCheck(options: RunGuardrailCheckOptions): Promise<GuardrailCheckResult>;
//# sourceMappingURL=check.d.ts.map