import type { ScanConfig } from "./types/configuration.js";
import type { SuppressionConfig, SuppressionExpiration } from "./types/diagnostics.js";
export declare const SCAN_BOUNDARY_SCHEMA_VERSION: "renma.scan-boundary.v1";
export declare const CI_EVIDENCE_BOUNDARY_SCHEMA_VERSION: "renma.ci-evidence-boundary.v1";
export interface CanonicalSuppressionEvidence {
    id: string;
    paths: string[];
    reason: string;
    expires: SuppressionExpiration;
}
/** Raw endpoint source used to evaluate target paths under an archived boundary. */
export interface ScanBoundarySource {
    configPath: string | null;
    globs: string[];
    exclude: string[];
    maxFileSizeBytes: number;
    maxDepth: number;
    suppressions: SuppressionConfig[];
}
/** Canonical, deterministic evidence for one revision-local scan boundary. */
export interface ScanBoundaryEvidence {
    schemaVersion: typeof SCAN_BOUNDARY_SCHEMA_VERSION;
    configPath: string | null;
    globs: string[];
    exclude: string[];
    maxFileSizeBytes: number;
    maxDepth: number;
    activeSuppressions: CanonicalSuppressionEvidence[];
}
/** CI's fail-closed target coverage model and the exact paths it retained. */
export interface EffectiveCiScanBoundaryEvidence {
    schemaVersion: typeof CI_EVIDENCE_BOUNDARY_SCHEMA_VERSION;
    coverageModel: "target_path_endpoint_coverage_union";
    configPath: null;
    globs: string[];
    exclude: string[];
    maxFileSizeBytes: number;
    maxDepth: number;
    activeSuppressions: CanonicalSuppressionEvidence[];
    /** Ordered base (`from`) then target (`to`). */
    sourceBoundaries: ScanBoundaryEvidence[];
    inspectedPaths: string[];
}
export type EffectiveScanBoundaryEvidence = ScanBoundaryEvidence | EffectiveCiScanBoundaryEvidence;
export declare function scanBoundarySource(config: ScanConfig, configPath?: string): ScanBoundarySource;
export declare function canonicalScanBoundary(source: ScanBoundarySource, today?: Date | string): ScanBoundaryEvidence;
export declare function effectiveCiScanBoundary(sources: readonly ScanBoundarySource[], trustedSuppressions: readonly SuppressionConfig[], inspectedPaths: readonly string[], today?: Date | string): EffectiveCiScanBoundaryEvidence;
/**
 * Suppression scopes trusted on both revisions at the evaluation date.
 *
 * Reason-only changes remain equivalent. The trusted lifetime is the stricter
 * endpoint lifetime (`never` is positive infinity), so tightening does not
 * reactivate a finding and weakening cannot extend base trust.
 */
export declare function trustedCiSuppressions(from: readonly SuppressionConfig[], to: readonly SuppressionConfig[], today?: Date | string): SuppressionConfig[];