/**
 * Block-time hint generation.
 *
 * When the guardrail check rejects a finding, the developer needs
 * three things to act on it:
 *
 *   1. **Remediation** — the recommended fix (rotate the secret,
 *      upgrade the package, split the file, etc.). Generic per-kind
 *      prose; the conversational `dxkit-fix` skill produces
 *      LLM-backed, code-aware fixes when available.
 *   2. **Inline example** — the exact annotation comment to paste
 *      when the finding has a stable single-line attachment point
 *      and the chosen category is inline-compatible.
 *   3. **CLI command** — the exact `npx vyuh-dxkit allowlist add`
 *      invocation that handles the mutation without the developer
 *      typing annotation syntax.
 *
 * # Canonical input shape (CLAUDE.md Rule 9)
 *
 * This module consumes `BaselineEntry` directly — the canonical
 * per-kind discriminated union from `src/baseline/types.ts`. NO
 * intermediate "BlockingFinding" projection. The discriminated
 * union flows into the switch statements below so TypeScript's
 * exhaustiveness check fails the build when a new `IdentityKind`
 * variant is added without matching `case` branches here.
 *
 * Language is inferred from the entry's file path (when present)
 * via the canonical `LANGUAGES` registry. No language-specific
 * branches; pack additions auto-propagate.
 *
 * The returned `BlockHint` is a plain data object so callers can
 * render it as terminal output, emit it as JSON for the skill /
 * future MCP surface, etc. Rendering text lives at the call site,
 * NOT here.
 */
import type { BaselineEntry, FindingSeverity } from '../baseline/types';
import { type AllowlistCategory } from './categories';
export interface BlockHint {
    /** Generic per-kind remediation text. Always present. */
    readonly remediation: string;
    /** Categories that semantically apply to this kind. Empty for
     *  `license` (which drops out of the baseline producer registry
     *  in 2.6+). */
    readonly applicableCategories: readonly AllowlistCategory[];
    /** Inline annotation example. Populated only when the entry has
     *  a stable single-line attachment, the kind's first applicable
     *  category is inline-compatible, and the language is inferable
     *  from the file extension. */
    readonly inlineExample?: string;
    /** Shell command for the CLI write path. Always present. */
    readonly cliCommand: string;
    /** True when the kind has no inline-compatible category
     *  applicable (e.g. hygiene — only accepted-risk + deferred,
     *  both file-only). The CLI / skill routes the dev directly to
     *  the file-level surface when true. */
    readonly fileLevelOnly: boolean;
    /** Pointer to the file-level allowlist surface when an expiring
     *  category (accepted-risk / deferred) might apply. */
    readonly fileLevelHint?: string;
}
/**
 * Build the structured block-time hint from a baseline entry.
 * Pure function — no IO, no side effects. The caller renders the
 * fields into its medium of choice.
 *
 * The optional `severity` parameter is reserved for future
 * remediation-prose tuning (e.g. "rotate IMMEDIATELY" for
 * critical-severity secrets). Currently unused but threaded
 * through so callers don't need to refactor when the prose
 * starts varying on severity.
 */
export declare function formatBlockHint(entry: BaselineEntry, severity?: FindingSeverity): BlockHint;
/**
 * Generic per-kind remediation text. Exhaustive switch on the
 * canonical `BaselineEntry['kind']` union — TypeScript enforces
 * every variant has prose so a new kind can't ship without
 * matching `case` branches.
 */
export declare function remediationFor(kind: BaselineEntry['kind']): string;
//# sourceMappingURL=hint.d.ts.map