/**
 * Network-read-only fetch edge for the Prop 296 §14 posture probes
 * (mmnto-ai/totem-strategy#962). The CLI EDGE owns the network — core's
 * `parity-detect.ts` keeps its module-wide never-networks + synchronous-pure
 * invariant, so this module resolves the per-repo, per-surface SNAPSHOTS the
 * pure detector then verdicts against.
 *
 * §14 hard edges honored here:
 *   1. Read-only, ever — every request is an authenticated `gh api` GET; nothing
 *      mutates ([Tenet 13]).
 *   2. Auth is the hard edge, rendered honestly — a missing/under-privileged
 *      token, an unreachable host, or a repo-scoped CI token that cannot see a
 *      sibling repo degrades to a per-SURFACE cannot-verify outcome
 *      (`auth`/`not-found`/`error`), never a drift verdict and never a
 *      manifest-wide outage. `no-transport` (gh absent / offline) is the distinct
 *      honest-absent (§14 clause 4) signal.
 *   3. Per-repo verdict lines — the roster resolves one snapshot per repo; the
 *      current repo (derived from the LOCAL git remote — no network) is always in
 *      the roster, cross-repo reads are opt-in via `orient.parityProbeRepos`.
 *   4. Offline degradation — gh unavailable ⇒ every surface `no-transport` ⇒
 *      every line renders as the honest-absent stub. NO retries.
 *
 * Transport is behind an INJECTABLE seam ({@link GhFetch}) so tests feed canned
 * JSON and NEVER spawn `gh`. The default spawns `gh api` via `safeExec` (arg
 * arrays, no `shell: true`, bounded timeout) — the git-subprocess pattern the
 * core detectors already use.
 */
import type { NetworkPostureRow, NetworkProbeRepoSnapshot, NetworkSurfaceOutcome } from '@mmnto/totem';
/** Resolve a contract id to its network-posture row kind, or undefined when unregistered. */
export declare function networkPostureRowFor(contractId: string): NetworkPostureRow | undefined;
/** One fetched surface plus its outcome — what {@link GhFetch} returns. */
export interface GhFetchResult {
    outcome: NetworkSurfaceOutcome;
    /** Parsed JSON body when `outcome === 'ok'`. */
    data?: unknown;
    /** Optional render detail (e.g. `HTTP 403`). */
    detail?: string;
}
/**
 * Injectable transport seam: issue one read-only GitHub API GET against
 * `apiPath` (an absolute `/repos/...` path) from `cwd`. Tests inject a canned
 * implementation; production omits it and the default spawns `gh api`.
 */
export type GhFetch = (apiPath: string, cwd: string) => GhFetchResult;
/** Injectable local-remote reader (default `git remote get-url origin`). */
export type ReadRemote = (cwd: string) => string | undefined;
/** One network-posture row present in the manifest (id-derived row kind + its consumers scope). */
export interface NetworkRowSpec {
    row: NetworkPostureRow;
    consumers?: string[];
}
/** Options for {@link resolveNetworkSnapshots}. */
export interface ResolveNetworkSnapshotsOptions {
    /** The network-posture rows present in the manifest (drives which surfaces to fetch). */
    rows: NetworkRowSpec[];
    /** Current repo's cohort id (for `consumers` scoping of the current-repo slug). */
    repoId?: string;
    /** The git root the local remote is read from + `gh` runs in. */
    gitRoot: string;
    /** Optional cross-repo read set (`orient.parityProbeRepos`), each an `owner/repo` slug. */
    probeRepos?: string[];
    /** Injectable transport (default spawns `gh api`). */
    ghFetch?: GhFetch;
    /** Injectable local-remote reader (default reads `git remote get-url origin`). */
    readRemote?: ReadRemote;
}
/**
 * Resolve the per-repo, per-surface snapshots the network-posture detector
 * verdicts against. Fetches ONCE per (repo, surface) — the union of surfaces the
 * in-scope rows need for each repo — with NO caching and NO retries. Never
 * throws: a transport/auth failure becomes a per-surface outcome, never a crash.
 *
 * The function is async to keep the network step BEFORE the synchronous detector
 * dispatch (the default transport is a synchronous `gh api` spawn; the async
 * boundary future-proofs an async transport).
 */
export declare function resolveNetworkSnapshots(options: ResolveNetworkSnapshotsOptions): Promise<NetworkProbeRepoSnapshot[]>;
/**
 * Extract `owner/repo` from an ssh (`git@host:owner/repo.git`) or https
 * (`https://host/owner/repo.git`) remote URL, tolerating a trailing `.git` and
 * slashes. Returns undefined when no `owner/repo` pair resolves.
 */
export declare function slugFromRemoteUrl(remoteUrl: string | undefined): string | undefined;
//# sourceMappingURL=doctor-parity-fetch.d.ts.map