/**
 * Proof of minimal change — for a deterministic (fixKind: "deterministic")
 * finding, produce a minimal patched YAML + unified diff so a PR can show it
 * changes exactly the flagged line and nothing else.
 *
 * No LLM, no API key — purely mechanical text edits. Findings that need
 * judgment (fixKind: "guidance") are NOT auto-fixed here; they return
 * `applied: false` with the catalog remediation as guidance. Any LLM-assisted
 * apply of a guidance fix is a separate, optional, local concern.
 *
 * Edits are applied directly to the YAML text (not via a model round-trip), so
 * the patched output differs only where intended — the diff proves it.
 */
import { type RuleMeta } from "./catalog.js";
export interface ProveOptions {
    /** Resolve an action ref (e.g. "actions/checkout@v4") to a 40-char SHA. */
    resolveSha?: (action: string, ref: string) => string | undefined;
    /** Resolve a container image (e.g. "node:20") to a "sha256:..." digest. */
    resolveDigest?: (image: string) => string | undefined;
    /** Resolved audit catalog for the check's `fixKind`/remediation lookup (#687). Defaults to core's static `RULE_CATALOG`. */
    catalog?: Record<string, RuleMeta>;
}
export interface ProofResult {
    checkId: string;
    /** True when a deterministic fix was produced. */
    applied: boolean;
    /** Full patched content (only when applied). */
    patched?: string;
    /** Unified diff of the change (only when applied). */
    diff?: string;
    /** Guidance/explanation when not applied (guidance fix, no-op, or needs-sha). */
    note?: string;
    /**
     * Why the result is what it is:
     *  - applied: a fix was produced
     *  - noop: nothing to fix (issue absent, or already resolved by a prior fix)
     *  - needs-input: deterministic but blocked on external input (e.g. a SHA)
     *  - guidance: not auto-fixable; needs human judgement
     */
    reason: "applied" | "noop" | "needs-input" | "guidance";
}
/** Extract unpinned `uses: action@ref` references (deduped) from workflow YAML. */
export declare function extractUnpinnedActions(content: string): Array<{
    action: string;
    ref: string;
}>;
/** Extract unpinned `image:` references (deduped) from CI YAML. */
export declare function extractUnpinnedImages(content: string): string[];
/**
 * Produce a deterministic fix + diff for a finding, if one is mechanical.
 * Returns `applied: false` with guidance for non-deterministic findings.
 */
export declare function proveFix(checkId: string, content: string, opts?: ProveOptions): ProofResult;
/** Render a unified diff with up to `context` equal lines around changes. */
export declare function unifiedDiff(oldStr: string, newStr: string, context?: number): string;
//# sourceMappingURL=proof.d.ts.map