/**
 * Deterministic code-based system audit.
 *
 * Lands the 2026-04-22 owner decision (mama_conductor_audit_code_based_read_only):
 * the hourly audit is fact collection and recording, executed by code - no LLM
 * invocation, no auto-fix, no filesystem access beyond explicit read-only checks.
 * The previous LLM audit loop once exfiltrated a credential when its report
 * path failed; this module removes that class of failure structurally.
 *
 * Every check here is read-only and local. MAJOR findings are alerted through
 * a caller-provided callback subject to the 24h dedup contract the checklist
 * established (alert only NEW / ESCALATED / older-than-24h re-alerts). MINOR
 * and INFO findings are recorded in the state file, never alerted.
 */
export type AuditSeverity = 'INFO' | 'MINOR' | 'MAJOR';
export interface AuditFinding {
    id: string;
    severity: AuditSeverity;
    summary: string;
    detail?: string;
}
interface StoredFinding {
    id: string;
    severity: AuditSeverity;
    summary?: string;
    detail?: string;
    first_seen: string;
    last_seen: string;
    last_alerted_at: string | null;
}
export interface AuditStateFile {
    audit_date: string;
    audit_timestamp: string;
    checklist_version: string;
    findings: StoredFinding[];
    resolved_since_last_run: string[];
    pass_items: string[];
}
export interface CodeAuditReport {
    mode: 'code';
    timestamp: string;
    duration_ms: number;
    findings: AuditFinding[];
    pass_items: string[];
    alerted: string[];
    alert_delivery_failures: string[];
    resolved_since_last_run: string[];
}
export type AuditAlertReason = 'new' | 'escalated' | 're-alert';
export interface CodeAuditConfigView {
    telegram?: {
        enabled?: boolean;
        allowed_chats?: string[];
    };
    multi_agent?: {
        enabled?: boolean;
        agents?: Record<string, {
            persona_file?: string;
            enabled?: boolean;
        }>;
    };
    roles?: {
        sourceMapping?: Record<string, string>;
        definitions?: Record<string, unknown>;
    };
}
export interface CodeAuditOptions {
    /** Base dir for ~/.mama files. Tests inject a temp dir. */
    mamaDir?: string;
    /** Findings/dedup state file. Default: <mamaDir>/state/audit-findings.json */
    stateFilePath?: string;
    /** Daemon log whose size is checked. Default: <mamaDir>/logs/daemon.log */
    daemonLogPath?: string;
    /** Local health endpoint. Default: http://127.0.0.1:3847/health. '' disables. */
    healthUrl?: string;
    /** Loaded runtime config (already-validated view). */
    config?: CodeAuditConfigView;
    /** True when a security alert sender is registered (checklist hygiene item). */
    securityAlertConfigured?: boolean;
    /** MAJOR-only alert callback, invoked per the 24h dedup contract. */
    alert?: (finding: AuditFinding, reason: AuditAlertReason) => void | Promise<void>;
    /** Injectable clock for tests. */
    now?: () => Date;
}
export declare function runCodeAudit(options?: CodeAuditOptions): Promise<CodeAuditReport>;
export {};
//# sourceMappingURL=code-audit.d.ts.map