import type { EnforcerRuntime, IProcessRunner, ProcessResult, ProcessSpec } from './enforcer.types';
export declare function buildRestorePlan(runtime: EnforcerRuntime): ProcessSpec[];
export interface ProjectScope {
    readonly projects: readonly string[];
    readonly unscoped: boolean;
}
export declare function resolveProjectScope(changedFiles: readonly string[], projectRoots: readonly string[]): ProjectScope;
export declare function computeEvaluationCacheKey(commitSha: string, changedFiles?: readonly string[], extra?: readonly string[]): string;
export interface IEvaluationCache<T> {
    get(key: string): T | undefined;
    set(key: string, value: T): void;
    has(key: string): boolean;
}
export declare class InMemoryEvaluationCache<T> implements IEvaluationCache<T> {
    private readonly store;
    get(key: string): T | undefined;
    set(key: string, value: T): void;
    has(key: string): boolean;
}
export interface SandboxPolicy {
    readonly allowEgress: boolean;
    readonly allowSecrets: boolean;
    readonly binaryAllowlist: readonly string[];
    readonly timeoutMs: number;
    readonly ulimits?: Readonly<Record<string, number>>;
}
export declare const DEFAULT_SANDBOX_POLICY: SandboxPolicy;
export interface SandboxDecision {
    readonly allowed: boolean;
    readonly violations: readonly string[];
}
export declare function enforceSandboxPolicy(spec: ProcessSpec, policy?: SandboxPolicy): SandboxDecision;
export declare class SandboxedProcessRunner implements IProcessRunner {
    private readonly inner;
    private readonly policy;
    constructor(inner: IProcessRunner, policy?: SandboxPolicy);
    run(spec: ProcessSpec): Promise<ProcessResult>;
}
interface ManifestCommand {
    readonly command?: string;
    readonly args?: readonly string[];
}
interface ToolchainSection {
    readonly runtime?: string;
    readonly restore?: readonly ManifestCommand[];
}
interface ToolchainManifest {
    readonly toolchain?: ToolchainSection;
    readonly runtime?: string;
}
export declare function resolveRuntimeFromManifest(manifest: ToolchainManifest | undefined): EnforcerRuntime | undefined;
export declare function resolveRestorePlanFromManifest(manifest: ToolchainManifest | undefined): ProcessSpec[] | undefined;
export interface RestoreStepResult {
    readonly command: string;
    readonly args: readonly string[];
    readonly exitCode: number;
    readonly ok: boolean;
}
export interface RestoreResult {
    readonly ok: boolean;
    readonly steps: readonly RestoreStepResult[];
    readonly failedStep: number;
}
export declare function executeRestorePlan(plan: readonly ProcessSpec[], runner: IProcessRunner, cwd?: string): Promise<RestoreResult>;
export interface ProvisionRequest {
    readonly runtime: EnforcerRuntime;
    readonly checkoutPath: string;
    readonly commitSha: string;
    readonly changedFiles?: readonly string[];
    readonly projectRoots?: readonly string[];
    readonly cacheDiscriminators?: readonly string[];
    readonly restorePlan?: readonly ProcessSpec[];
}
export interface ProvisionedEnvironment {
    readonly runtime: EnforcerRuntime;
    readonly checkoutPath: string;
    readonly scope: ProjectScope;
    readonly cacheKey: string;
    readonly cached: boolean;
    readonly restore?: RestoreResult;
    readonly ready: boolean;
}
export declare function provisionEvaluationEnvironment(req: ProvisionRequest, runner: IProcessRunner, cache?: IEvaluationCache<ProvisionedEnvironment>): Promise<ProvisionedEnvironment>;
export interface RepositorySourceRef {
    readonly owner?: string;
    readonly repo?: string;
    readonly ref?: string;
    readonly workspaceRef?: string;
}
export interface RepositorySources {
    readonly commitSha: string;
    readonly files: Readonly<Record<string, string>>;
}
export interface IRepositorySourceReader {
    fetchSources(ref: RepositorySourceRef): Promise<RepositorySources>;
}
export interface IWorkspaceMaterializer {
    materialize(files: Readonly<Record<string, string>>): Promise<string>;
}
export type ManifestParser = (text: string) => unknown;
export interface MaterializeProvisionRequest {
    readonly source: RepositorySourceRef;
    readonly changedFiles?: readonly string[];
    readonly projectRoots?: readonly string[];
    readonly cacheDiscriminators?: readonly string[];
    readonly runtime?: EnforcerRuntime;
}
export interface MaterializedEnvironment extends ProvisionedEnvironment {
    readonly source: RepositorySourceRef;
    readonly commitSha: string;
    readonly analysisPaths: readonly string[];
}
export declare function materializeAndProvisionEnvironment(req: MaterializeProvisionRequest, deps: {
    readonly reader: IRepositorySourceReader;
    readonly materializer: IWorkspaceMaterializer;
    readonly runner: IProcessRunner;
    readonly cache?: IEvaluationCache<MaterializedEnvironment>;
    readonly parseManifest?: ManifestParser;
}): Promise<MaterializedEnvironment>;
export {};