/**
 * Diagnostics contract (C6).
 *
 * `/healthz` answers one question — is the process up — and returns
 * `{ ok, version }`. When a user's session will not start, that tells them
 * nothing about why: the provider CLI may be missing, the database may have
 * failed to migrate, the PTY subsystem may be unavailable, or the clock may be
 * skewed enough to break token validation.
 *
 * This produces a structured report where each subsystem is checked
 * independently, so one failure never masks another, and every failure carries a
 * STABLE remediation code the client can map to instructions without parsing
 * English.
 *
 * Redaction is a contract requirement, not a nicety: this endpoint is designed
 * to be copied into a bug report. See `redactPath` below.
 */
export declare const DIAGNOSTICS_CONTRACT_VERSION = 1;
export type CheckStatus = "ok" | "degraded" | "failed" | "unknown";
/**
 * Stable, machine-readable remediation identifiers.
 *
 * Clients map these to localized instructions, so they are part of the contract:
 * renaming one is a breaking change. New codes may be added; existing ones must
 * keep their meaning.
 */
export type RemediationCode = "PROVIDER_NOT_INSTALLED" | "PROVIDER_VERSION_UNVERIFIED" | "DB_UNAVAILABLE" | "DB_MIGRATION_PENDING" | "PTY_UNAVAILABLE" | "CACHE_DEGRADED" | "CLOCK_SKEWED" | "FS_SCOPE_MISSING" | "NONE";
export interface DiagnosticCheck {
    /** Stable identifier for the subsystem, e.g. "database". */
    id: string;
    status: CheckStatus;
    /** Human-readable summary. Never contains secrets or full paths. */
    summary: string;
    remediation: RemediationCode;
    /** Structured, redacted detail. Optional. */
    detail?: Record<string, string | number | boolean | null>;
}
export interface DiagnosticsReport {
    contractVersion: number;
    generatedAt: string;
    /** Worst status across all checks — a single field for a client to branch on. */
    overall: CheckStatus;
    checks: DiagnosticCheck[];
}
/**
 * Reduce a filesystem path to its last two segments.
 *
 * A full path leaks the user's home directory layout, their username, and often
 * client or project names. The tail is enough to recognize *which* directory is
 * meant when you already know your own machine, which is all a diagnostic needs.
 */
export declare function redactPath(path: string | null | undefined): string | null;
/** Worst status wins, so a single failure is never hidden by surrounding successes. */
export declare function worstStatus(checks: DiagnosticCheck[]): CheckStatus;
/**
 * Clock skew against a trusted reference, in milliseconds.
 *
 * Matters because pair tokens carry a 180-second TTL: a device whose clock is
 * far enough off will have every pairing attempt rejected as expired, with no
 * indication that time is the cause.
 */
export declare const CLOCK_SKEW_WARN_MS = 60000;
export declare function clockSkewCheck(localNow: number, referenceNow: number | null): DiagnosticCheck;
export declare function buildReport(checks: DiagnosticCheck[], now?: Date): DiagnosticsReport;
export declare function redactValue<T>(value: T): T;
//# sourceMappingURL=diagnostics.d.ts.map