import { type ScanReport } from '../../types/scanReport.types';
export declare const hashLicenseId: (licenseKey: string) => string;
export interface UploadScanInput {
    /** From userConfig.scanHistory.enabled. False or undefined = no-op. */
    enabled: boolean;
    /** Raw license key. Hashed before transmission - the backend never
     * sees the unhashed key. */
    licenseKey?: string;
    /** Cognito JWT from the existing CLI auth flow. Required. */
    authToken?: string;
    /** Tier label ('free' | 'pro' | 'team' | 'trial'). Stored on the scan
     * metadata so dashboard list views can show tier. */
    tier?: string;
    /** Pre-built scan report from buildScanReport(). */
    report: ScanReport;
}
/**
 * Cross-customer, k-anonymity-gated fix-rate stats for a rule, computed by
 * the recommendation-effectiveness engine from opt-in scan history. Optional
 * ride-along on the scan-upload response - absent on older servers, when the
 * effectiveness feed is down, or when no rule clears the anonymity gate.
 * Aggregates only: no customer identifiers of any kind.
 */
export interface RuleEffectivenessStat {
    ruleId: string;
    /** 0..1 share of affected teams that fixed the finding. */
    fixRate: number;
    /** Coarse median time-to-resolve band, e.g. '1-7d'. Null when unknown. */
    medianTimeToResolveBand: string | null;
    /** Lifecycle episodes behind the stat (>= the anonymity gate). */
    samples: number;
}
export interface UploadScanResult {
    /** Distinguishes "didn't try" (skipped) from "tried and failed" (sent). */
    skipped: boolean;
    success?: boolean;
    scanId?: string;
    viewUrl?: string;
    retentionDays?: number;
    /** Optional per-rule fix-rate stats (see RuleEffectivenessStat). */
    effectiveness?: RuleEffectivenessStat[];
    /**
     * Why the upload was skipped or failed. Strings are stable across
     * versions - surface them in the terminal block.
     */
    reason?: 'disabled' | 'no-license-key' | 'no-auth-token' | 'no-api-base' | 'network' | 'timeout' | 'rejected' | 'server-error';
    /** Server's error message when reason==='rejected' or 'server-error'. */
    serverMessage?: string;
}
/**
 * Best-effort scan upload. Always returns - never throws. Caller decides
 * how to surface success/failure to the user (terminal block in
 * analyse.ts, but other commands could reuse this).
 *
 * Privacy: sends `hashedLicenseId` (sha256, 32 hex chars) and the report
 * body. Never the raw license key. Mirrors the telemetry envelope's
 * privacy posture in `telemetryClient.ts`.
 */
export declare const uploadScan: (input: UploadScanInput) => Promise<UploadScanResult>;
/** Generates a fresh scanId for a new analyse run. UUID v4, lowercase. */
export declare const newScanId: () => string;