import { closeSync, openSync, writeFileSync } from "node:fs";
import { createOnePasswordResolver, type SecretResolver } from "./onepassword.js";
import { type ConfigIssue, type EffectiveConfig } from "./protocol.js";
/**
 * CLI command surface and diagnostics orchestration.
 * Handles subcommand parsing, safe human/json output formatting, and reveal gating.
 */
type CliStreams = {
    stdin: NodeJS.ReadableStream;
    stdout: NodeJS.WritableStream;
    stderr: NodeJS.WritableStream;
};
type CliRuntime = {
    env?: NodeJS.ProcessEnv;
    cwd?: string;
    entryScriptPath?: string;
    streams?: Partial<CliStreams>;
    resolver?: SecretResolver;
    createResolver?: typeof createOnePasswordResolver;
    confirmReveal?: () => Promise<boolean>;
    runResolver: (runtime?: {
        env?: NodeJS.ProcessEnv;
        stdin?: NodeJS.ReadableStream;
        stdout?: NodeJS.WritableStream;
        resolver?: SecretResolver;
    }) => Promise<void>;
};
type TableColumn = {
    header: string;
    maxWidth?: number;
};
export type ResolveRow = {
    id: string;
    status: "resolved" | "unresolved";
    output: string;
    reason: string;
};
type OnePasswordProbeReason = "resolved" | "sdk-unresolved" | "policy-blocked" | "invalid-ref" | "config-invalid" | "token-missing" | "sdk-init-failed" | "probe-runtime-failed" | "not-requested";
export type OnePasswordProbeResult = {
    requested: boolean;
    id?: string;
    status: "resolved" | "unresolved" | "filtered" | "skipped";
    reason: OnePasswordProbeReason;
};
export type OnePasswordCheckPayload = {
    status: "clean" | "findings" | "error" | "runtime-error";
    checkMode: boolean;
    tokenPresent: boolean;
    sdkStatus: "ok" | "skipped" | "error";
    config: {
        path: EffectiveConfig["path"];
        valid: boolean;
        errors: number;
        warnings: number;
    };
    probe: OnePasswordProbeResult;
    issues: Array<{
        code: string;
        message: string;
        key?: string;
        level?: string;
    }>;
};
export type OnePasswordDiagnosePayload = OnePasswordCheckPayload & {
    resolverConfig: Record<string, unknown>;
    resolverProvenance: Record<string, {
        value: unknown;
        source: string;
        notes: string[];
    }>;
    resolverIssues: ConfigIssue[];
    policy: {
        defaultVault: string;
        vaultPolicy: string;
        vaultWhitelistCount: number;
        allowedIdRegexState: "unset" | "configured" | "fail-closed";
    };
};
type SafeWriteFsOps = {
    openSync: typeof openSync;
    writeFileSync: typeof writeFileSync;
    closeSync: typeof closeSync;
};
export declare function parseFlags(args: string[]): {
    positionals: string[];
    flags: Map<string, string[]>;
};
export declare function getLastFlag(flags: Map<string, string[]>, name: string): string | undefined;
export declare function hasFlag(flags: Map<string, string[]>, name: string): boolean;
export declare function getStringFlag(flags: Map<string, string[]>, name: string): string | undefined;
export declare function truncateCell(value: string, maxWidth: number): string;
export declare function displayValue(value: unknown): string;
export declare function renderAsciiTable(columns: TableColumn[], rows: string[][]): string;
export declare function writeConfigFileSafely(options: {
    filePath: string;
    body: string;
    overwrite: boolean;
    fsOps?: Partial<SafeWriteFsOps>;
}): {
    ok: true;
} | {
    ok: false;
    message: string;
};
export declare function buildRowsForNoRequestedRefs(sanitizedIds: string[], unresolvedReasons: Map<string, string>): ResolveRow[];
export declare function buildRowsForResolvedRefs(options: {
    sanitizedIds: string[];
    unresolvedReasons: Map<string, string>;
    requestedRefs: string[];
    refToId: Map<string, string>;
    resolved: Map<string, string>;
    reveal: boolean;
}): ResolveRow[];
export declare function toResolveJsonPayload(rows: ResolveRow[], options: {
    debug: boolean;
    reveal: boolean;
}): {
    debug: boolean;
    reveal: boolean;
    results: Array<{
        id: string;
        status: string;
        output: string;
        reason?: string;
    }>;
};
export declare function renderResolveTable(rows: ResolveRow[], debug: boolean): string;
export declare function runCli(argv: string[], runtime: CliRuntime): Promise<number>;
export declare function ensureRevealAllowed(options: {
    reveal: boolean;
    yes: boolean;
    streams: CliStreams;
    confirm?: () => Promise<boolean>;
}): Promise<boolean>;
export declare function canReadPath(filePath: string): boolean;
export {};
//# sourceMappingURL=cli.d.ts.map