import type { JupiterOneClient } from '../../client/jupiterone-client.js';
/**
 * What a string literal in a query turned out to mean against the account's real data.
 *
 * `partial-case-match` is the reason this exists. A query filtering `severity = 'high'` against a
 * property that also holds `HIGH` and `High` succeeds, returns a plausible non-zero count, and
 * silently under-reports by a third — so the widget is not blank, it is confidently wrong. Blank
 * gets investigated; a confident number gets believed.
 */
export type DiagnosisVerdict = 'case-mismatch' | 'partial-case-match' | 'type-mismatch' | 'property-never-set' | 'target-empty' | 'value-not-found' | 'literal-ok' | 'split-categories' | 'unverifiable';
export interface LiteralDiagnosis {
    queryName?: string;
    target: string;
    field: string;
    operator: '=' | '!=';
    literal: string;
    verdict: DiagnosisVerdict;
    /** Entities matching the literal exactly. Null when the probe could not establish it. */
    exactCount: number | null;
    /** Only same-value-different-casing groups, never a dump of the property's values. */
    variants?: Array<{
        value: string;
        count: number;
    }>;
    correctedQuery?: string;
    note: string;
}
export declare const DIAGNOSIS_BUDGET_MS = 20000;
/**
 * Budget for a diagnosis pass that runs after a write has already succeeded, anchored at request
 * start by its caller.
 *
 * Tighter than the read-path budget because overrunning costs something different in kind: a
 * response that lands after the host has given up makes the agent retry a create that worked, and
 * the duplicate it then makes is the collision this diagnosis exists to help avoid.
 */
export declare const POST_WRITE_DIAGNOSIS_BUDGET_MS = 15000;
/**
 * Diagnose a query's string literals against live data.
 *
 * Advisory by construction and never blocking: every verdict is point-in-time. Between two
 * measurements 48 hours apart on the same account, one entity type disappeared entirely and another
 * property's casing was normalised — so a data-dependent block would make identical widget JSON
 * succeed one day and fail the next.
 *
 * `maxProbes` caps values, not written literals: the casings of one value are folded into a single
 * group and probed once (see `groupCasings`), so a multi-casing enumeration neither spends the
 * budget several times over nor reports its own arms as findings.
 */
export declare function diagnoseQueryLiterals(client: JupiterOneClient, query: string, options?: {
    queryName?: string;
    maxProbes?: number;
    deadlineAt?: number;
}): Promise<LiteralDiagnosis[]>;
/**
 * Entity targets in a query that match nothing in this account.
 *
 * The quietest failure there is: a widget on a type the account does not hold returns one row
 * containing `0` from `count(e)`, so it renders a confident zero forever and every row-based check
 * calls it healthy. Probed directly rather than checked against `list-entity-types`, because that
 * index has been measured omitting types live queries return — it is a positive oracle only, so a
 * type missing from it would produce a false "does not exist".
 */
export declare function diagnoseEmptyTargets(client: JupiterOneClient, query: string, options?: {
    deadlineAt?: number;
    maxProbes?: number;
}): Promise<LiteralDiagnosis[]>;
/**
 * Whether the categories this chart will actually draw collapse into fewer than they appear.
 *
 * Judged on the rows the preflight already fetched, which is both free and the only correct
 * population: an earlier version probed the target's whole population instead, and would have
 * reported `Finding.severity` as split (eighteen casings) for a widget filtered to
 * `status = 'open'`, whose real output is four clean lowercase categories. The widget's own filters
 * are part of the question.
 *
 * The failure it does catch is real: an unfiltered severity chart renders eighteen bars for six
 * severities, `high`/`HIGH`/`High` each getting one, plus an unlabelled bar for the rows with no
 * value at all. Every count is then a fraction of its true total and it still looks like a chart.
 */
export declare function detectCategorySplit(target: string, field: string, categoryColumn: string, resultRows: unknown[], options?: {
    queryName?: string;
    measure?: string;
}): LiteralDiagnosis | null;
//# sourceMappingURL=value-probe.d.ts.map