import type { CliFlagOptions, CliOptions, DefaultableCliOptions, ResolvedCliOptions } from '../config/cli-options';
/** Recursively-optional variant of `T` — lets the resolver be typed against the CLI option shapes while accepting partial objects. */
type DeepPartial<T> = T extends (infer U)[] ? DeepPartial<U>[] : T extends object ? {
    [K in keyof T]?: DeepPartial<T[K]>;
} : T;
/**
 * The source that provided the final value for a config path, in precedence order
 * (highest wins): flag > env > file > default. `unset` means no source provided it.
 */
export declare enum ConfigSource {
    FLAG = "flag",
    ENV = "env",
    FILE = "file",
    DEFAULT = "default",
    UNSET = "unset"
}
/** A single entry in the curated allowlist of config paths reported via telemetry. */
export type ReportedConfigEntry = {
    /** Dot-notation path into the resolved CLI options, e.g. `build.index`. */
    path: string;
    /** Name of the environment variable (if any) that can supply this value. */
    envVar?: string;
    /** Whether the resolved value itself is safe to report (default: false — source only). */
    reportValue?: boolean;
};
/** A resolved config path with its winning source and (optionally) its value. */
export type ResolvedConfigEntry = {
    path: string;
    value?: string;
    source: ConfigSource;
};
/**
 * The curated allowlist of config paths reported via the `appConfigMetrics` bizevent.
 * This is the privacy gate: only paths listed here ever leave the machine.
 */
export declare const REPORTED_CONFIG: ReportedConfigEntry[];
/** The four config sources considered when resolving provenance, plus the final merged result. */
export type ConfigProvenanceSources = {
    argsConfig: DeepPartial<CliFlagOptions>;
    fileConfig: DeepPartial<CliOptions>;
    envConfig: Record<string, string | undefined>;
    defaults: DeepPartial<DefaultableCliOptions>;
    resolved: DeepPartial<ResolvedCliOptions>;
};
/**
 * Sanitizes a config value for telemetry. Unlike {@link sanitizeErrorMessage}, this is
 * purpose-built for config values: it does NOT split on spaces or strip path segments,
 * so relative path-shaped values (e.g. `"ui/custom.html"`) are preserved intact. If the
 * value is an absolute path, only its basename is reported (e.g.
 * `/home/user/app/index.html` -> `index.html`) to avoid leaking local filesystem
 * structure or usernames. It then caps the length.
 * @param raw The raw value to sanitize (already stringified by the caller)
 * @returns The sanitized value, capped at {@link MAX_CONFIG_VALUE_LENGTH} characters
 */
export declare function sanitizeConfigValue(raw: string): string;
/**
 * Resolves, for each allowlisted config path, which source won (flag > env > file >
 * default > unset) and — when permitted — its sanitized value. Pure and side-effect-free.
 * @param sources The four config sources plus the final merged/resolved options
 * @param allowlist The set of paths to resolve (defaults to {@link REPORTED_CONFIG})
 * @returns One resolved entry per allowlisted path
 */
export declare function resolveConfigProvenance(sources: ConfigProvenanceSources, allowlist?: ReportedConfigEntry[]): ResolvedConfigEntry[];
export {};