export type DiscoveryExclusionKind = 'sensitive' | 'unreadable';
export type DiscoveryExclusionReason = 'environment_file' | 'private_key' | 'credential_store' | 'secret_config' | 'sensitive_directory' | 'unreadable_path' | 'unreadable_directory';
export interface DiscoveryExclusion {
    path: string;
    kind: DiscoveryExclusionKind;
    reason: DiscoveryExclusionReason;
}
export interface DiscoverySafetySummary {
    total: number;
    sensitive: number;
    unreadable: number;
    reasons: Partial<Record<DiscoveryExclusionReason, number>>;
}
export interface DiscoverySafetyMetadata {
    version: 1;
    summary: DiscoverySafetySummary;
    /** Local-only paths. Share-safe surfaces must emit summary data, never this array. */
    exclusions: DiscoveryExclusion[];
}
export interface RelevantDiscoveryExclusions {
    total: number;
    relevant: number;
    reasons: Partial<Record<DiscoveryExclusionReason, number>>;
    relevantReasons: Partial<Record<DiscoveryExclusionReason, number>>;
    hasUnreadable: boolean;
}
export declare function localDiscoveryPath(root: string, path: string): string;
export declare function isSensitiveDirectoryName(name: string): boolean;
export declare function sensitiveDirectoryReasonForPath(path: string, root: string): Extract<DiscoveryExclusionReason, 'credential_store' | 'sensitive_directory'> | null;
/**
 * Source-aware secret policy:
 * - private key material, environment files, and known credential stores are never read;
 * - ordinary source files are indexable regardless of security-related names or ancestors;
 * - non-source secret configs and files below explicit secret directories are not read.
 */
export declare function sensitiveArtifactReason(path: string, root: string, options: {
    isSourceFile: boolean;
}): Extract<DiscoveryExclusionReason, 'environment_file' | 'private_key' | 'credential_store' | 'secret_config' | 'sensitive_directory'> | null;
export declare function summarizeDiscoveryExclusions(exclusions: readonly DiscoveryExclusion[]): DiscoverySafetySummary;
export declare function buildDiscoverySafetyMetadata(exclusions: readonly DiscoveryExclusion[]): DiscoverySafetyMetadata;
export declare function parseDiscoverySafetyMetadata(value: unknown): DiscoverySafetyMetadata | null;
export declare function readDiscoverySafetyMetadata(graphPath: string): DiscoverySafetyMetadata | null;
export declare function relevantDiscoveryExclusions(metadata: DiscoverySafetyMetadata, input: {
    question?: string;
    coveredWorkflowOwners?: readonly string[];
}): RelevantDiscoveryExclusions;