import type { ReleaseSpec } from "../namespaces/deploy.types.js";
export interface SourceScanFinding {
    code: string;
    severity: string;
    file: string;
    line?: number;
    message: string;
    canonical_name?: string;
    [key: string]: unknown;
}
interface ScanOptions {
    excludeFiles?: Set<string>;
    cwd?: string;
    filePath?: string;
    declaredCapabilities?: Set<string> | string[];
}
/** Severity ladder for scanner findings. `error` blocks deploy; `warn`
 *  reports but doesn't block. The `run402 doctor` exit code is non-zero
 *  whenever any `error`-severity finding is present. */
export declare const SCAN_SEVERITY: Readonly<{
    ERROR: "error";
    WARN: "warn";
}>;
/** Scan a single file's content. Returns the array of findings (zero
 *  or more). Pure / no I/O — tests pass strings directly. */
export declare function scanFileContent(content: string, opts?: ScanOptions): SourceScanFinding[];
/** Recursively walk `srcDir` and scan every file with a relevant
 *  extension. Returns the combined findings list, sorted by file +
 *  line for stable output. */
export declare function scanSourceTree(srcDir: string, opts?: ScanOptions): SourceScanFinding[];
/** Scan an explicit list of on-disk file paths — no directory walk.
 *  Used by `run402 deploy apply` for manifest/spec/stdin deploys, where
 *  the artifact is exactly the set of files the manifest references, NOT
 *  whatever happens to live under cwd/src. Files without a
 *  scannable extension are ignored; unreadable files become a WARN
 *  finding (never throw). Returns the combined findings list, sorted by
 *  file + line for stable output, exactly like `scanSourceTree`. */
export declare function scanSourceFiles(filePaths: string[], opts?: ScanOptions): SourceScanFinding[];
/** Convenience for tests: synchronous, no FS access. */
export declare function _testOnly_hallucinatedNames(): {
    name: string;
    canonical: string;
    origin: string;
}[];
export declare function _testOnly_authProperties(): {
    name: string;
    canonical: string;
}[];
/** Read the union of `capabilities` declared across all function entries in
 *  `run402.config.json` (the apply spec). Used by the tenant-assertion mint
 *  check (#8) to suppress the warning when "auth.sessionMint" is declared.
 *
 *  Functions live under `functions.replace.<name>` / `functions.set.<name>`
 *  with `capabilities?: string[]` as a sibling to `config`. Best-effort:
 *  a missing or malformed config returns an empty set (the scanner then
 *  warns, which is the safe default — the runtime gate is the hard
 *  enforcement). Returns a `Set<string>`. */
export declare function readDeclaredCapabilities(cwd?: string): Set<string>;
/** Resolve the project's src/ directory. Astro convention is `<root>/src`;
 *  bare Node projects use `<root>/src` or `<root>`. We prefer `src/` if
 *  it exists. */
export declare function resolveScanRoot(cwd?: string): string;
/** The same selected-app scope gates up/apply and is reported by doctor. */
export declare function scanDeploymentSources(spec: Partial<ReleaseSpec>, appRoot: string, sourceRoot?: string): {
    app_root: string;
    scan_root: string;
    checked_files: number;
    explicit_references: number;
    findings: SourceScanFinding[];
    errors: SourceScanFinding[];
};
export {};
//# sourceMappingURL=source-scan.d.ts.map