/**
 * Spec-09 — invariant assertions over tool output.
 *
 * Pure, dependency-light checks that must hold for ANY tool run against ANY real
 * repo. They OBSERVE current behavior — they impose no new limits (that is
 * spec-10). Budgets are deliberately generous: the point is to catch pathological
 * blowups and leaks, not to enforce spec-10's tighter caps.
 *
 * Everything here is pure and unit-tested offline; the integration suite feeds it
 * real tool output.
 */
/** Generous ceilings — only pathological output trips these. Tunable per spec-10. */
export declare const BYTE_BUDGET = 2000000;
export declare const TOKEN_BUDGET = 200000;
/** Serialize any handler result deterministically for scanning/budgeting. */
export declare function serializeResult(result: unknown): string;
/** Returns the names of any secret patterns detected in `text` (empty = clean). */
export declare function scanForSecrets(text: string): string[];
/**
 * Returns any machine-specific absolute path prefixes leaked into `text`. Tool
 * output should be repo-relative; the runner's home dir or the cache dir's
 * absolute prefix appearing verbatim is a leak (a finding for spec-10).
 */
export declare function scanForPathLeaks(text: string, forbiddenAbsPaths: string[]): string[];
export interface BudgetReport {
    bytes: number;
    tokens: number;
    withinBudget: boolean;
}
/** Measure serialized size against the generous byte + token budgets. */
export declare function checkBudget(serialized: string): BudgetReport;
/** A structured result is well-formed if it is present and not a bare primitive
 * other than a non-empty string. null/undefined where structure is required fails. */
export declare function hasValidShape(result: unknown): boolean;
/**
 * Minimal per-tool documented-shape contract. Only tools with a clear, stable
 * public shape are listed; everything else is covered by the generic invariants.
 * Each predicate receives the raw handler result. Keep these to the DOCUMENTED
 * shape — do not invent stricter contracts (spec-09 §5.5).
 */
export declare const REQUIRED_FIELDS: Record<string, (r: unknown) => boolean>;
export interface InvariantContext {
    /** Absolute paths that must NOT appear in output (home dir, cache dir, repo dir). */
    forbiddenAbsPaths: string[];
    /** When true, the tool is listed in this repo's expectNonEmpty. */
    expectNonEmpty: boolean;
}
export interface InvariantResult {
    ok: boolean;
    bytes: number;
    tokens: number;
    /** Human-readable failure reasons; empty when ok. */
    failures: string[];
}
/**
 * Run all invariants for one tool×repo result. Does not throw — returns a
 * structured verdict the runner turns into a test assertion + report row.
 * (A handler that itself throws is caught by the runner before this is called.)
 */
export declare function checkInvariants(toolName: string, result: unknown, ctx: InvariantContext): InvariantResult;
/** Non-trivial = has some content: non-empty string, non-empty array, or an object
 * with at least one non-empty array/string/number field. */
export declare function isNonTrivial(result: unknown): boolean;
//# sourceMappingURL=invariants.d.ts.map