import { type MigrationManifest } from "../package-lifecycle/index.js";
export type GuardName = "no-drizzle-push" | "no-unscoped-credentials" | "no-unscoped-queries" | "no-env-credentials" | "db-tool-scoping" | "no-env-mutation" | "no-localhost-fallback" | "explicit-collab-access" | "migration-manifest";
export declare const ALL_GUARD_NAMES: GuardName[];
export interface DoctorConfig {
    disabledGuards: string[];
    dbToolScopingDenylist: Record<string, string>;
    failOnBuild: boolean;
}
export interface DoctorFinding {
    guard: string;
    file: string;
    line: number;
    message: string;
}
export interface DoctorReport {
    ok: boolean;
    findings: DoctorFinding[];
    warnings: DoctorFinding[];
    guardsRun: string[];
}
/**
 * Reads the optional `"doctor"` key from `<root>/agent-native.json`. All
 * fields are optional with sane empty defaults — an app needs zero config
 * to run `agent-native doctor` with every v1 guard enabled.
 */
export declare function readDoctorConfig(root: string): DoctorConfig;
export interface RunDoctorScanOptions {
    root: string;
    /** Restrict to these guard names. When omitted, runs every guard not
     * listed in `agent-native.json`'s `doctor.disabledGuards`. Unknown names
     * are silently ignored here — the CLI layer (`runDoctor`) validates
     * `--only` and reports a usage error before calling this. */
    only?: string[];
    migrationManifests?: MigrationManifest[];
}
/** Pure scan orchestrator: runs the selected guards against `root` and
 * returns a flat report. No I/O beyond reading `agent-native.json` and the
 * app source tree — no printing, no process.exit. */
export declare function runDoctorScan(options: RunDoctorScanOptions): DoctorReport;
/** Pure escalation rule shared by the CLI (`--strict`) and the `build`
 * pre-step (`--strict` / `agent-native.json` `doctor.failOnBuild`). Doctor
 * findings never fail anything on their own — only `strict` or
 * `failOnBuild` turn findings into a hard failure. */
export declare function shouldFailBuild(hasFindings: boolean, opts: {
    strict?: boolean;
    failOnBuild?: boolean;
}): boolean;
export interface DoctorIo {
    log: (message: string) => void;
    err: (message: string) => void;
}
export interface DoctorCliOptions {
    json?: boolean;
    cwd?: string;
    only?: string[];
    strict?: boolean;
    help?: boolean;
    fix?: boolean;
}
export declare function parseDoctorArgs(argv: string[]): DoctorCliOptions;
export declare function printDoctorHelp(io?: Pick<DoctorIo, "log">): void;
/** `agent-native doctor` CLI entrypoint. Returns the process exit code —
 * callers are responsible for calling `process.exit(code)`. */
export declare function runDoctor(argv: string[], io?: DoctorIo): Promise<number>;
export interface DoctorBuildHookOptions {
    cwd: string;
    /** Set when the caller passed `agent-native build --strict`. */
    strict?: boolean;
}
export interface DoctorBuildHookResult {
    /** False only when findings are present AND (`strict` was requested OR
     * `agent-native.json`'s `doctor.failOnBuild` is true). */
    ok: boolean;
    report: DoctorReport;
}
/**
 * `agent-native build`'s doctor pre-step. Always runs every enabled guard
 * and always prints findings (as warnings) to `io.err` — never silent.
 * Never causes the build to fail unless `strict` was passed or
 * `agent-native.json` sets `doctor.failOnBuild: true` (see report 005,
 * "Where it runs" — the v1 doctor has zero field mileage against arbitrary
 * app layouts, so shipping fail-by-default would risk breaking a first
 * deploy on a false positive).
 */
export declare function runDoctorBuildHook(options: DoctorBuildHookOptions, io?: DoctorIo): Promise<DoctorBuildHookResult>;
//# sourceMappingURL=doctor.d.ts.map