/**
 * Audit-digest push client (SMI-5541 Wave 2C Stage 2, Option 1).
 *
 * The security audit runs CLIENT-side (the inventory data plane is
 * metadata-only, ADR-124), so the digest's email channel is a thin push: this
 * client authenticates with the stored device-login session and POSTs a
 * COMPACT findings summary — never raw skill content — to the gateway-verified
 * `audit-notify` edge function, which gates on consent + a verified email
 * server-side and sends the email via Resend.
 *
 * The payload contract here is the client-side twin of the edge function's
 * `parseDigest`: `{ scanned, hostile, malicious, suspicious, findings }`, each
 * finding `{ identifier, kind, verdict, reason }`. Defined independently in
 * `@skillsmith/core` (which must not depend on `@skillsmith/mcp-server`); the
 * mapping from a `RunSecurityAuditResult` into this shape lives in
 * `@skillsmith/mcp-server/audit` (`buildAuditDigestPayload`), which can see
 * both types.
 *
 * @module @skillsmith/core/sync/audit-notify-client
 */
/** The three security verdicts the digest carries (mirrors the edge fn). */
export type AuditDigestVerdict = 'hostile' | 'malicious' | 'suspicious';
/** One compact finding in a pushed digest. Carries NO raw skill content. */
export interface AuditDigestPushFinding {
    /** Skill/command/agent identifier (e.g. `author/name`). */
    identifier: string;
    /** Inventory kind (`skill` | `command` | `agent`). */
    kind: string;
    verdict: AuditDigestVerdict;
    /** One human-readable sentence citing the deciding signal. */
    reason: string;
}
/** The compact digest pushed to `audit-notify`. Mirrors the edge fn's parser. */
export interface AuditDigestPushPayload {
    scanned: number;
    hostile: number;
    malicious: number;
    suspicious: number;
    findings: AuditDigestPushFinding[];
}
/**
 * Outcome of a push. `ok`/`sent`/`reason` mirror the edge function's 200-body
 * shapes so callers can render a precise message without re-deriving:
 *   - `{ ok: true,  sent: true }`                         — email dispatched.
 *   - `{ ok: true,  sent: false, reason: 'nothing_to_report' }`
 *   - `{ ok: false, reason: 'not_consented' | 'email_not_verified' | 'no_email' }`
 *   - `{ ok: false, sent: false, reason: 'email_send_failed' }`
 */
export interface AuditDigestPushResult {
    ok: boolean;
    sent: boolean;
    reason?: string;
}
/**
 * No usable device session. The message hints at the recovery action so the
 * CLI/MCP surface can relay it.
 */
export declare class AuditNotifyAuthError extends Error {
    constructor(message?: string);
}
/**
 * Catch-all for transport failures and unexpected server responses (HTTP 5xx,
 * 400 `invalid_payload`, network errors, unparseable bodies).
 */
export declare class AuditNotifyError extends Error {
    constructor(message: string);
}
/**
 * Push a compact audit digest to the `audit-notify` edge function.
 *
 * A `200` response is returned verbatim as an {@link AuditDigestPushResult} —
 * this INCLUDES the consent-off `{ ok: false, reason: 'not_consented' }` and
 * the `{ ok: true, sent: false, reason: 'nothing_to_report' }` no-ops, which
 * are successful round-trips, not errors.
 *
 * @param payload - The compact digest (never raw content).
 * @returns The edge function's outcome.
 * @throws {AuditNotifyAuthError} HTTP 401, or no/expired session.
 * @throws {AuditNotifyError} HTTP 400/5xx, network failure, or unparseable 200 body.
 * @see SMI-5541
 */
export declare function sendAuditDigest(payload: AuditDigestPushPayload): Promise<AuditDigestPushResult>;
//# sourceMappingURL=audit-notify-client.d.ts.map