/**
 * Audit core — run chant's CI security checks against arbitrary repo YAML.
 *
 * The post-synth security checks (`lexicons/<lex>/src/lint/post-synth/*.ts`)
 * read the emitted workflow YAML from `ctx.outputs`, not the chant model
 * (`ctx.entities`). So an auditor can feed *existing* repo YAML straight in as
 * a synthetic output and run the real rules — no import-to-chant-model step.
 *
 * Each file is audited as its own `primary` output so single-document security
 * checks (the merge-worthy tier: permissions, pinning, injection, secrets)
 * fire on every workflow. Cross-file checks (e.g. duplicate workflow names)
 * only see one file at a time here; that is acceptable because the security
 * tier is per-document.
 *
 * Checks that read `ctx.entities` instead of `ctx.outputs` will not fire on
 * audited YAML — the security tier is YAML-based, so this is by design.
 */
import type { Severity } from "../lint/rule.js";
import type { PostSynthCheck } from "../lint/post-synth.js";
/**
 * The lexicon whose post-synth checks run against an audited file. Any lexicon
 * name is accepted — `defaultChecksProvider` loads the plugin by name — so a
 * caller can audit a lexicon outside the built-in set. The listed names are the
 * ones with built-in content detection (see `discover.ts`), kept here only for
 * editor autocomplete; `(string & {})` keeps the union open.
 */
export type AuditLexicon = "github" | "gitlab" | "forgejo" | "k8s" | "docker" | "aws" | "azure" | "gcp" | "helm" | (string & {});
/** A single CI file to audit. */
export interface AuditInput {
    /** Path used to tag findings (e.g. ".github/workflows/ci.yml"). */
    path: string;
    /** Raw content of the file. */
    content: string;
    /** Which lexicon's checks to run against it. */
    lexicon: AuditLexicon;
    /**
     * Bundle inputs (e.g. a Helm chart) supply a files map keyed by relative path
     * — checks that read `output.files` (helm, docker) see the whole bundle.
     */
    files?: Record<string, string>;
}
/** A finding produced by a post-synth check against an audited file. */
export interface AuditFinding {
    checkId: string;
    severity: Severity;
    message: string;
    /** The audited file this finding came from. */
    file: string;
    /** The lexicon that produced the finding. */
    lexicon: string;
    /** Optional entity (e.g. job name) the check attached. */
    entity?: string;
}
/**
 * Resolve the post-synth checks for a lexicon. Injectable so the core can be
 * unit-tested without loading real lexicon packages.
 */
export type ChecksProvider = (lexicon: AuditLexicon) => Promise<PostSynthCheck[]>;
/**
 * Default provider: load the lexicon plugin(s) and return their post-synth
 * checks. Forgejo workflows are GitHub-dialect YAML, so the GitHub security
 * tier is run against them in addition to Forgejo's own checks.
 */
/** Thrown when a lexicon package the audit needs isn't installed. */
export declare class MissingLexiconError extends Error {
}
/**
 * Audit a set of CI files and return all findings. Pure with respect to the
 * filesystem and network — callers supply file contents.
 */
export declare function auditFiles(inputs: AuditInput[], opts?: {
    checksProvider?: ChecksProvider;
}): Promise<AuditFinding[]>;
/** Label for findings that span more than one file (e.g. duplicate names). */
export declare const CROSS_FILE = "(cross-file)";
//# sourceMappingURL=core.d.ts.map