import type { AssuranceReport } from "../assure/index.js";
import type { RunReport } from "../types.js";
/**
 * Telling the service what happened, without telling it anything private.
 *
 * Two constraints shape everything here, and they pull in opposite directions.
 *
 * The first is that this record *is* the evidence. `POSITIONING.md` says the
 * deliverable an auditor accepts is a period-bounded export reading "control
 * operated 8,742 times, 3 exceptions, coverage 47/47 tenant tables" — so
 * coverage has to be measured against the whole catalogue, with exclusions
 * named, or that sentence can never be written. History cannot be backfilled,
 * which means a payload that omits coverage today is a year of evidence that
 * omits it.
 *
 * The second is that we are the company telling founders their data is safe.
 * Shipping a customer's row values to our own servers while doing it would be
 * indefensible. So the payload is built by an **allowlist**: fields are copied
 * in by name, never copied wholesale and then redacted. A denylist is one new
 * field away from a leak, and `Violation` already carries two fields — the
 * evidence string and the reproduction command — that quote real data.
 */
export declare const PAYLOAD_VERSION = 1;
/**
 * What the record says happened.
 *
 * `unable_to_prove` is a first-class outcome rather than an absence, because
 * `GOAL.md` and `POSITIONING.md` both require it: a gap in the population reads
 * to an auditor as a control that stopped operating, and "did not run" must be
 * distinguishable from "ran and could not reach the database".
 */
export type Outcome = "clean" | "exception" | "inconclusive"
/** Assurance only: the running rules are not the ones a proof was made against. */
 | "drifted" | "unable_to_prove";
export interface VerdictPayload {
    schemaVersion: number;
    /**
     * Which control operated.
     *
     * The two are different claims and an export that merges them would be
     * misleading: a proof demonstrates isolation by experiment, an assurance
     * check reads the rules and compares them to what a proof established. "The
     * control operated 8,742 times" has to say which one.
     */
    kind: "proof" | "assurance";
    /** Stable for a given run, so a retry cannot double-write an append-only log. */
    runId: string;
    client: string;
    clientVersion: string;
    startedAt: string;
    finishedAt: string;
    outcome: Outcome;
    /** Host and database only. Never a password, never a query string. */
    target: string;
    coverage: {
        /** Every table in the catalogue, checked or not. The denominator. */
        total: number;
        checked: string[];
        excluded: {
            tableId: string;
            reason: string;
        }[];
    };
    /** Metadata only: what kind of failure, where. Never what was read. */
    findings: {
        id: string;
        severity: string;
        tableId: string;
        actor: string;
        operation: string;
        plane: string;
        title: string;
    }[];
    /** Why nothing was established, when nothing was. */
    reasons: string[];
}
/** A record for a run that never happened, or could not reach the database. */
export declare function unableToProve(opts: {
    at: string;
    target: string;
    reason: string;
    clientVersion: string;
    kind?: "proof" | "assurance";
}): VerdictPayload;
/**
 * The record for a run that happened.
 *
 * Note what is *not* here: `evidence`, `repro`, `rowsVisible`, the canary
 * values, the connection string's credentials, anything from the ownership
 * model. A reader of this payload can tell that `public.documents` was readable
 * by the wrong user and cannot tell what was in it.
 */
export declare function payloadFor(report: RunReport, target: string): VerdictPayload;
/**
 * The record for a read-only assurance check.
 *
 * Same envelope as a proof, different control, and its own allowlist. What is
 * excluded here is narrower than it looks: a `StaticFinding` carries the
 * catalogue text verbatim so a human can check it by hand, and a policy
 * expression can contain literals a founder put there. `fact` therefore stays
 * on their machine, and so does the drift detail beyond the one line naming
 * what moved.
 *
 * Coverage is every table the check examined, which for this control is the
 * whole catalogue it read — that is the denominator an export needs.
 */
export declare function assurancePayloadFor(report: AssuranceReport): VerdictPayload;
/**
 * Report an assurance check, and return the one line to print.
 *
 * Same silence rule as {@link reportRun}: nothing when it was never enrolled,
 * loud when it is enrolled and could not report.
 */
export declare function reportAssurance(report: AssuranceReport, deps?: {
    fetch?: typeof globalThis.fetch;
    env?: NodeJS.ProcessEnv;
    timeoutMs?: number;
}): Promise<string | null>;
/**
 * The database, named without its credentials.
 *
 * A connection string carries a password and often a token in its query
 * parameters. What the record needs is only enough to tell two databases apart.
 */
export declare function redactTarget(target: string): string;
export type SendOutcome = {
    sent: true;
    runId: string;
} | {
    sent: false;
    reason: string;
    enrolled: boolean;
};
/**
 * Send it, and never let this be the reason a check fails.
 *
 * The founder's question is answered by the run, not by us hearing about it. A
 * service outage, an expired token or an offline laptop must leave the local
 * result exactly as it was — this returns why it could not report and the
 * caller prints it, rather than throwing into a run that has already succeeded.
 */
export declare function sendVerdict(payload: VerdictPayload, deps?: {
    fetch?: typeof globalThis.fetch;
    env?: NodeJS.ProcessEnv;
    /** Bounded so a hanging service cannot hang a founder's check. */
    timeoutMs?: number;
}): Promise<SendOutcome>;
/**
 * Report a finished run, and return the one line the founder should read.
 *
 * The silence rule is deliberate and runs in one direction only.
 *
 * An installation that was never enrolled says **nothing**. `GOAL.md` promises
 * the local run stays free and uncrippled, and a line on every single run
 * advertising a service they did not ask for is exactly the damage that promise
 * rules out — it is how a tool becomes something people uninstall.
 *
 * An installation that *is* enrolled and could not report says so every time.
 * They are paying for something to be watching, and a check whose result
 * silently failed to reach the watcher has quietly stopped being watched.
 * Silent blindness is worse than bad news.
 */
export declare function reportRun(report: RunReport, target: string, deps?: {
    fetch?: typeof globalThis.fetch;
    env?: NodeJS.ProcessEnv;
    timeoutMs?: number;
}): Promise<string | null>;