/** Deterministic, secret-aware context selection and provenance. */
export type LocalContextOrigin = "project" | "dependency" | "private_documentation" | "diagnostic";
export interface ContextRangeV1 {
    startLine: number;
    endLine: number;
}
export interface LocalContextCandidateV1 {
    origin: LocalContextOrigin;
    path: string;
    reason: string;
    range?: ContextRangeV1;
    priority?: number;
    required?: boolean;
    version?: string;
}
export interface OfficialDocumentationCandidateV1 {
    origin: "official_documentation";
    url: string;
    version: string;
    content: string;
    /** Hash supplied by the documentation cache/retriever. */
    contentSha256: string;
    reason: string;
    cached: boolean;
    range?: ContextRangeV1;
    priority?: number;
    required?: boolean;
}
export type ContextCandidateV1 = LocalContextCandidateV1 | OfficialDocumentationCandidateV1;
export interface ContextRedactionV1 {
    kind: SecretKind;
    line: number;
}
export interface LocalContextEvidenceV1 {
    id: string;
    origin: LocalContextOrigin;
    path: string;
    version?: string;
    startLine: number;
    endLine: number;
    sha256: string;
    reason: string;
    content: string;
    redactions: ContextRedactionV1[];
    untrusted: true;
}
export interface OfficialDocumentationEvidenceV1 {
    id: string;
    origin: "official_documentation";
    url: string;
    version: string;
    cached: boolean;
    startLine: number;
    endLine: number;
    sha256: string;
    reason: string;
    content: string;
    redactions: ContextRedactionV1[];
    untrusted: true;
}
export type ContextEvidenceV1 = LocalContextEvidenceV1 | OfficialDocumentationEvidenceV1;
export type ContextExclusionCode = "DUPLICATE" | "BUDGET" | "EMPTY" | "OPTIONAL_UNAVAILABLE";
export interface ContextExclusionV1 {
    location: string;
    code: ContextExclusionCode;
    reason: string;
}
export interface ContextBudgetV1 {
    maxItems: number;
    maxBytes: number;
    maxEstimatedTokens: number;
    maxBytesPerItem: number;
}
export interface ContextBudgetUsageV1 extends ContextBudgetV1 {
    usedItems: number;
    usedBytes: number;
    usedEstimatedTokens: number;
}
export interface ContextManifestV1 {
    schemaVersion: 1;
    projectFingerprint: string;
    offline: boolean;
    evidence: ContextEvidenceV1[];
    exclusions: ContextExclusionV1[];
    budget: ContextBudgetUsageV1;
    redactionCount: number;
}
export interface ContextSelectionOptions {
    root: string;
    projectFingerprint: string;
    candidates: ContextCandidateV1[];
    offline?: boolean;
    secretPolicy?: "block" | "redact";
    budget?: Partial<ContextBudgetV1>;
    /** Hostnames (or parent domains) approved as authoritative sources. */
    officialDocumentationHosts?: string[];
}
export declare const DEFAULT_CONTEXT_BUDGET: Readonly<ContextBudgetV1>;
export declare const DEFAULT_OFFICIAL_DOCUMENTATION_HOSTS: readonly string[];
export type SecretKind = "private_key" | "aws_access_key" | "api_token" | "github_token" | "google_api_key" | "credential_assignment" | "credential_url";
export interface SecretFindingV1 {
    kind: SecretKind;
    line: number;
    start: number;
    end: number;
}
export type ContextErrorCode = "INVALID_ROOT" | "PATH_ESCAPE" | "PROTECTED_PATH" | "SYMLINK_BLOCKED" | "NOT_A_FILE" | "BINARY_BLOCKED" | "SECRET_DETECTED" | "BUDGET_EXCEEDED" | "DOCUMENTATION_BLOCKED" | "DOCUMENTATION_HASH_MISMATCH" | "OFFLINE_MISS" | "INVALID_CANDIDATE";
export declare class ContextSecurityError extends Error {
    readonly code: ContextErrorCode;
    readonly location: string | undefined;
    constructor(code: ContextErrorCode, message: string, location?: string);
}
/** Filename-only protection, intentionally independent of ignore rules. */
export declare function isProtectedContextPath(path: string): boolean;
/** Returns metadata only; the matched credential is never exposed. */
export declare function scanSecrets(content: string): SecretFindingV1[];
/**
 * Picks the least-privilege slice of the project the model is allowed to see
 * when turning a reviewed request into code. Selection is deterministic, never
 * touches the network, and never executes or imports project code.
 */
export declare function selectContext(options: ContextSelectionOptions): Promise<ContextManifestV1>;
export type ContextRequestKind = "symbol" | "file" | "dependency-doc" | "diagnostic";
export interface ContextRequestV1 {
    schemaVersion: 1;
    requestId: string;
    kind: ContextRequestKind;
    workspace: string;
    query: string;
    reason: string;
    maxItems: number;
    /** Required by strict tool schemas; null unless kind is `file`. */
    path: string | null;
}
/** Exact-schema validator for compiler-agent context tool calls. */
export declare function validateContextRequestV1(value: unknown): ContextRequestV1;
export declare class ContextRequestLimitError extends Error {
    readonly maximum: number;
    constructor(maximum: number);
}
/** Stateful per-run gate: validate first, then count, with a hard maximum of 8. */
export declare class ContextRequestSession {
    #private;
    readonly maximum: number;
    constructor(maximum?: number);
    accept(value: unknown): ContextRequestV1;
    get count(): number;
    get remaining(): number;
    get accepted(): readonly ContextRequestV1[];
}
/** Exact validator for context manifests loaded from disk or a run store. */
export declare function validateContextManifestV1(value: unknown): ContextManifestV1;
export declare function hashContextManifest(manifest: ContextManifestV1): string;
//# sourceMappingURL=context.d.ts.map