import type { BoberConfig } from "../../config/schema.js";
/**
 * Orchestrator-owned real-diff provider (spec-20260714 sprint 6, ADR-5).
 *
 * Shells `git` in orchestrator Node — NEVER as an auditor tool — to compute
 * the actual changed files/hunks for a sprint, replacing the sprint-5 seam
 * that ranked signatures against `contract.estimatedFiles` only. Mirrors
 * `security-scanners.ts`'s injectable never-throw runner shape exactly
 * (Pattern A): any git failure (ENOENT, not-a-repo, abort, malformed
 * output) degrades to an empty `AuditDiff` rather than throwing, so a
 * broken git environment never crashes the audit — it just falls back to
 * `estimated-files` behavior.
 *
 * `AuditDiff` is the shared input type future sprints (7: supply-chain,
 * 8: verifier) will also consume — kept clean and exported.
 */
export interface DiffHunk {
    startLine: number;
    lineCount: number;
    content: string;
}
export interface ChangedFile {
    path: string;
    status: "added" | "modified" | "deleted" | "renamed";
    hunks: DiffHunk[];
}
export interface AuditDiff {
    changedFiles: ChangedFile[];
    neighborhoodFiles: string[];
    truncated: boolean;
}
export declare const EMPTY_DIFF: AuditDiff;
export interface GitRunResult {
    exitCode: number | undefined;
    stdout: string;
    failed: boolean;
}
export type GitRunner = (args: string[], opts: {
    cwd: string;
    signal: AbortSignal;
}) => Promise<GitRunResult>;
/**
 * Parse `git diff --name-status` + `git diff -U<n>` output into
 * `ChangedFile[]`, bounded by `MAX_CHANGED_FILES` (file count) and
 * `MAX_HUNK_BYTES` (total hunk content bytes). Pure and total — any
 * structural surprise (non-string input, malformed lines) is skipped
 * rather than thrown (Pattern B, mirrors `parseSlitherOutput`).
 */
export declare function parseUnifiedDiff(nameStatus: string, unified: string): {
    files: ChangedFile[];
    truncated: boolean;
};
/**
 * Tokenizes changed-hunk text into keywords for the selector's
 * keyword-overlap ranking (selector.ts). Pure and total: guards every
 * field access, never throws on malformed hunk content.
 */
export declare function extractDiffKeywords(files: ChangedFile[]): string[];
export interface SecurityDiffComputeInput {
    projectRoot: string;
    baseRef?: string;
    expandWithGraph: boolean;
    signal: AbortSignal;
    /** Needed for the `getGraphState(config).engineHealth === 'ready'` gate (sc-6-2). */
    config?: BoberConfig;
    /** Injected in tests — default wraps execa. */
    runner?: GitRunner;
}
export interface SecurityDiffProvider {
    compute(input: SecurityDiffComputeInput): Promise<AuditDiff>;
}
/**
 * Computes a real, bounded `AuditDiff` by shelling git in orchestrator
 * Node. NEVER throws: any failure (missing git, not-a-repo, abort,
 * malformed diff output) degrades to `EMPTY_DIFF`, which callers treat as
 * "fall back to estimated-files" rather than an audit-crashing error.
 */
export declare const securityDiffProvider: SecurityDiffProvider;
//# sourceMappingURL=diff-provider.d.ts.map