/**
 * Convex emission for command parameters with `trustedSource` (`from context.*`).
 *
 * Spec (semantics.md § Commands): strip client values, inject from authoritative
 * runtime context at the declared path, fail closed with MISSING_TRUSTED_CONTEXT
 * when required and unresolved. Convex resolves paths against
 * `getAuthContext(ctx)` (`__auth.context ?? __auth`).
 */
import type { IRCommand, IRParameter } from '../../ir';
import type { ProjectionDiagnostic } from '../interface';
import type { NormalizedOptions } from './generator.js';
export declare function trustedParameters(cmd: IRCommand): IRParameter[];
export declare function clientOwnedParameters(cmd: IRCommand): IRParameter[];
/** Resolve `context.a.b` against `__auth` (requires authBindings forceAuth). */
export declare function trustedSourceResolveExpr(trustedSource: string): string | null;
export type TrustedInjectMode = 'args' | 'locals';
/**
 * Diagnostics + injection lines for trusted params on a command.
 * Callers must force auth when any trusted param is present.
 */
export declare function renderTrustedSourceInjection(cmd: IRCommand, options: NormalizedOptions, mode: TrustedInjectMode): {
    lines: string[];
    diagnostics: ProjectionDiagnostic[];
};
//# sourceMappingURL=trusted-source-emit.d.ts.map