/**
 * Per-repo salt resolution for secret HMAC identity.
 *
 * The secret-HMAC scheme uses a salt that's:
 *   1. Consistent across `baseline create` (writes HMACs) and every
 *      subsequent `guardrail check` (reads them).
 *   2. Not stored in git — a baseline-file leak should not enable
 *      secret recovery via rainbow tables.
 *   3. Reachable from every consumer — single dev, multiple devs on
 *      one repo, CI, shallow clones, detached HEADs.
 *
 * A three-step waterfall satisfies all three:
 *
 *   1. `DXKIT_BASELINE_SALT` env var — opt-in override for teams
 *      who want stronger isolation than the deterministic default.
 *   2. `.dxkit/salt` file — reserved for environments where env-vars
 *      are awkward (cron jobs, embedded runners). Gitignored by
 *      default.
 *   3. Deterministic default — `HMAC("dxkit-baseline-salt-v1",
 *      initialCommitSha)`. Zero-setup; same across clones of the
 *      same repo; different across different repos; reachable in
 *      shallow clones (git always includes the root commit).
 *
 * Every baseline file records which mode produced it so the
 * matcher can either match the same mode (HMAC compare works) or
 * gracefully degrade to location-only matching when the salt is
 * unrecoverable on the current run.
 */
/** Resolution path that produced the salt. Stamped on every baseline
 *  file so the guardrail check knows what the matcher needs. */
export type SaltMode = 'env-var' | 'file' | 'deterministic';
export interface ResolvedSalt {
    readonly mode: SaltMode;
    readonly salt: string;
}
/**
 * Resolve the salt for a repo. Pure dispatch over the three-step
 * waterfall; no I/O happens past the resolution step that succeeds.
 *
 * Throws when none of the three paths can produce a salt — typically
 * a non-git checkout with no env var set. Callers should surface the
 * message verbatim so users learn which mode to configure.
 */
export declare function resolveSalt(cwd: string): ResolvedSalt;
//# sourceMappingURL=salt.d.ts.map