/**
 * `chant audit` — run chant's security, correctness, and best-practice checks against an existing repo's
 * pipeline YAML and emit a tiered report. Does not require a chant project;
 * it reads `.github/workflows`, `.gitlab-ci.yml`, and `.forgejo/workflows`
 * directly and runs the real post-synth checks via the audit core.
 */
import { type AuditInput, type AuditFinding, type ChecksProvider } from "../../audit/core.js";
import { type DetectPlugin, type UnclaimedFile } from "../../audit/discover.js";
import { type ReportTheme } from "../../audit/report-html.js";
export type AuditFormat = "stylish" | "json" | "sarif" | "markdown" | "html";
export type AuditTier = "merge-worthy" | "all";
export type AuditFailOn = "merge-worthy" | "warning" | "none";
export interface AuditCommandOptions {
    /** Repo root/dir to scan, or an https:// repo URL to fetch and audit. */
    path: string;
    format?: AuditFormat;
    /** Restrict findings to a tier (default "all"). */
    tier?: AuditTier;
    /** Exit-code policy (default "none" — read-only friendly). */
    failOn?: AuditFailOn;
    /** Server-side token for remote fetch (defaults to env). */
    token?: string;
    /** Injectable fetch for testing remote audits. */
    fetchImpl?: typeof fetch;
    /** Write the rendered report to this file instead of returning it for stdout. */
    output?: string;
    /** Injectable post-synth checks provider (testing). */
    checksProvider?: ChecksProvider;
    /** HTML report: theme knobs (title, logo, accent, footer). */
    theme?: ReportTheme;
    /** HTML report: full template override. */
    template?: string;
    /** Snapshot timestamp (ISO); defaults to now. Injectable for deterministic output. */
    now?: string;
    /** Tool version recorded in the HTML snapshot. */
    toolVersion?: string;
    /** Injectable detection plugins (testing); defaults to every installed audit lexicon. */
    plugins?: DetectPlugin[];
}
export interface AuditCommandResult {
    success: boolean;
    /** Rendered report in the requested format. */
    output: string;
    findings: AuditFinding[];
    /** Files that were scanned (relative to the root). */
    scanned: string[];
    exitCode: number;
    error?: string;
    /** Set when the report was written to a file (via `output`). */
    wroteTo?: string;
    /**
     * `"no-lexicons"` when not a single audit lexicon resolved, so nothing was
     * inspected (#1623). `output` then carries the diagnostic, not a report.
     */
    status?: "ok" | "no-lexicons";
    /** Candidate files that looked like they wanted a lexicon that is not installed. */
    unclaimed?: UnclaimedFile[];
    /** Where `output` belongs; diagnostics go to stderr, reports to stdout (default). */
    stream?: "stdout" | "stderr";
}
/** Exit code when the audit had no lexicons to look with. Distinct from 1 (findings / failure). */
export declare const NO_LEXICONS_EXIT_CODE = 2;
/**
 * The exact one-liner that gives a bare `npx @intentius/chant audit` the
 * lexicons it needs. Every wanted lexicon is a `-p` package so npx puts all of
 * them on the same resolution path.
 */
export declare function installLine(lexicons: string[], target: string): string;
/**
 * Select the fetch token for a repo host. Tokens are host-specific — a GitHub
 * PAT sent to GitLab/Codeberg is rejected (401) — so we never cross hosts.
 */
export declare function tokenForHost(url: string, env?: NodeJS.ProcessEnv): string | undefined;
/** Coverage caveats about what the audit could and couldn't see. */
export declare function coverageNotes(inputs: AuditInput[]): string[];
/** Run the audit and produce a rendered result. */
export declare function auditCommand(options: AuditCommandOptions): Promise<AuditCommandResult>;
/** Print an audit result to stdout. */
export declare function printAuditResult(result: AuditCommandResult): void;
//# sourceMappingURL=audit.d.ts.map