import type { ModelFingerprint } from "../assure/fingerprint.js";
/**
 * The check, running inside the application it is checking.
 *
 * This is the delivery model `GOAL.md` describes and the reason we never hold a
 * customer's database credentials: their application already has the
 * connection, so the check runs where it lives and only a verdict leaves. Same
 * shape as Sentry. A scheduled job in CI — which is what `crossline schedule`
 * writes — needs the founder to put their production connection string into a
 * repository secret, and this does not.
 *
 * Two things about the security of this route are load-bearing, because it is a
 * public HTTP endpoint on somebody's production application that reads their
 * authorization model.
 *
 * **It fails closed.** With no shared secret configured it refuses to run at
 * all rather than running unauthenticated. An endpoint that quietly answers
 * anybody is exactly the defect Crossline exists to find, and shipping one
 * inside the product would be indefensible.
 *
 * **It answers with a verdict and nothing else.** No findings, no table names,
 * no policy text. A caller who guesses the secret learns that something is
 * wrong, not what or where. The detail goes to the service, over an
 * authenticated request, and to nobody standing at the URL.
 */
/** Vercel sets this on its cron requests, and names it this. */
export declare const CRON_SECRET_ENV = "CRON_SECRET";
export interface WatchOptions {
    /**
     * Where to look for `crossline.lock`. Defaults to the process's working
     * directory, which on Vercel is the deployment root.
     */
    cwd?: string;
    /** Supply the fingerprint directly, for a deployment that bundles rather than ships files. */
    lock?: ModelFingerprint | null;
    /** Overrides `$DATABASE_URL`, for an app that names its connection differently. */
    connectionString?: string;
    /** Defaults to `["public"]`, plus `auth` as everywhere else. */
    schemas?: string[];
    env?: NodeJS.ProcessEnv;
}
/**
 * Build the request handler.
 *
 * Returns a plain `(Request) => Promise<Response>`, which is what Next.js app
 * routes, Remix, Hono, SvelteKit and Cloudflare Workers all already speak, so
 * there is no framework adapter to keep working:
 *
 * ```ts
 * // app/api/crossline/route.ts
 * import { watch } from "crossline/runtime";
 * export const GET = watch();
 * ```
 */
export declare function watch(options?: WatchOptions): (request: Request) => Promise<Response>;
/**
 * Whether this installation would report anything, for a setup check.
 *
 * Exported so an application can tell the difference between "running and
 * reporting" and "running into the void" without having to read a token.
 */
export declare function isEnrolled(env?: NodeJS.ProcessEnv): boolean;