declare const SAFE_RESULT_REFERENCE_KINDS: readonly ["manifest", "findings", "coverage", "report", "artifact"];
declare const UNVERIFIED_SOURCE_TRANSMISSION_PROPERTIES: readonly ["exact-transmitted-source-scope", "provider-endpoints", "provider-retention", "provider-encryption", "provider-telemetry", "proxy-behavior", "backend-untracked-file-inclusion"];
export type CodexSecurityCommandRunner = (command: string, args: string[], options: {
    cwd?: string;
}) => Promise<CodexSecurityCommandResult>;
export interface CodexSecurityCommandResult {
    code: number | null;
    stdout: string;
    detail: string;
}
export interface CodexSecurityManifest {
    schemaVersion: 1;
    name: "codex-security";
    package: "@openai/codex-security";
    version: "0.1.8";
    packageSpec: "@openai/codex-security@0.1.8";
    launcher: {
        command: "npx";
        args: ["--no-install", "@openai/codex-security@0.1.8"];
    };
    preflight: {
        version: ["--version"];
        node: "22.13.0+ on 22.x, 24.x, or 26.x";
        python: ">=3.10";
    };
    scan: {
        command: "scan";
        outputDirectoryFlag: "--output-dir";
        dryRunFlag: "--dry-run";
        targets: {
            workingTree: ["--working-tree", "--base", "{base}"];
            path: ["--path", "{path}"];
            diff: ["--diff", "{base}", "--head", "{head}"];
            wholeRepository: [];
        };
    };
    safety: {
        credentialHandling: "adapter-never-reads-or-infers-credentials";
        execution: "injected-runner-only";
        output: "caller-declared-private-location-outside-repository-and-enclosing-worktree";
        storedResults: CodexSecuritySafeResultReferenceKind[];
        sourceBearingOutput: "reference-only-never-copy-into-repository-by-default";
        acquisition: "separate-dependency-network-cache-write-approval-when-exact-cli-is-unavailable";
        unverifiedSourceTransmission: CodexSecurityUnverifiedSourceTransmissionProperty[];
    };
}
export type CodexSecuritySafeResultReferenceKind = typeof SAFE_RESULT_REFERENCE_KINDS[number];
export type CodexSecurityUnverifiedSourceTransmissionProperty = typeof UNVERIFIED_SOURCE_TRANSMISSION_PROPERTIES[number];
export type CodexSecurityTarget = {
    kind: "default-working-tree";
    base?: string;
    untrackedPaths: string[];
} | {
    kind: "paths";
    paths: string[];
} | {
    kind: "diff";
    base: string;
    head: string;
} | {
    kind: "whole-repository";
};
export type CodexSecurityUnitStatus = "planned" | "approved" | "completed" | "refused" | "failed" | "uncovered" | "unsupported";
export interface CodexSecurityPrivateOutput {
    path: string;
    declaredPrivate: true;
}
export interface CodexSecurityReviewContext {
    repositoryRoot: string;
    enclosingWorktreeRoot: string;
    privateOutput: CodexSecurityPrivateOutput;
}
export interface CodexSecurityRuntimeProbe {
    required: string;
    status: "compatible" | "missing" | "incompatible" | "invalid";
    observedVersion?: string;
}
export interface CodexSecurityReadiness {
    status: "ready" | "missing" | "incompatible" | "invalid";
    expectedVersion: "0.1.8";
    localExactCli: "available" | "unavailable";
    observedVersion?: string;
    node: CodexSecurityRuntimeProbe;
    python: CodexSecurityRuntimeProbe;
    credentials: "not-read-by-adapter";
    reason?: string;
}
export interface CodexSecurityApprovalRequirement {
    required: true;
    operation: "preview-unit" | "source-transmission-scan-unit";
    unitId: string;
}
export interface CodexSecurityDependencyAcquisitionApproval {
    required: true;
    operation: "dependency-network-cache-write-acquisition";
    package: "@openai/codex-security@0.1.8";
    effects: ["dependency", "network", "cache-write"];
    separateFromSourceTransmissionApproval: true;
    execution: "not-executed-by-adapter";
}
export interface CodexSecuritySourceTransmissionBoundary {
    status: "Unverified";
    properties: CodexSecurityUnverifiedSourceTransmissionProperty[];
}
export interface CodexSecurityScanUnit {
    id: string;
    kind: "tracked-working-tree" | "untracked-path" | "path" | "diff" | "whole-repository";
    repositoryRelativeIdentity: string;
    cliArgs: string[];
    dryRun: {
        command: "npx";
        args: string[];
        cwd: string;
        nonScanning: true;
    };
    previewApproval: CodexSecurityApprovalRequirement;
    sourceTransmissionApproval: CodexSecurityApprovalRequirement;
}
export interface CodexSecurityReviewPlan {
    package: "@openai/codex-security@0.1.8";
    repositoryRoot: string;
    enclosingWorktreeRoot: string;
    privateOutput: {
        path: string;
        privacy: "caller-declared-private; filesystem permissions and symlink topology Unverified";
        sourceBearingOutput: "reference-only-never-copy-into-repository-by-default";
    };
    credentials: "not-read-by-adapter";
    sourceTransmissionBoundary: CodexSecuritySourceTransmissionBoundary;
    units: CodexSecurityScanUnit[];
}
export interface CodexSecurityDryRunResult {
    unitId: string;
    status: "planned" | "blocked" | "failed";
    exitCode?: number | null;
    reason?: string;
}
export interface CodexSecurityDryRunSummary extends CodexSecurityReviewPlan {
    preflight: CodexSecurityReadiness;
    acquisitionApproval?: CodexSecurityDependencyAcquisitionApproval;
    dryRuns: CodexSecurityDryRunResult[];
}
export interface CodexSecuritySafeResultReference {
    kind: CodexSecuritySafeResultReferenceKind;
    path: string;
}
export interface CodexSecurityUnitOutcome {
    repositoryRelativeIdentity: string;
    status: CodexSecurityUnitStatus;
    sourceScanReferences?: string[];
    outputReferences?: CodexSecuritySafeResultReference[];
}
export interface CodexSecurityConvergedOutcome {
    repositoryRelativeIdentity: string;
    statuses: CodexSecurityUnitStatus[];
    state: "pending" | "complete" | "incomplete";
    sourceScanReferences: string[];
    outputReferences: CodexSecuritySafeResultReference[];
    discardedOutputReferences: number;
    sourceBearingOutputCopied: false;
}
export declare function loadCodexSecurityManifest(ailiHome: string): Promise<CodexSecurityManifest>;
export declare function inspectCodexSecurity(ailiHome: string, runner: CodexSecurityCommandRunner): Promise<CodexSecurityReadiness>;
export declare function planCodexSecurityReview(ailiHome: string, context: CodexSecurityReviewContext, target: CodexSecurityTarget): Promise<CodexSecurityReviewPlan>;
export declare function runCodexSecurityDryRuns(options: {
    ailiHome: string;
    context: CodexSecurityReviewContext;
    target: CodexSecurityTarget;
    runner: CodexSecurityCommandRunner;
}): Promise<CodexSecurityDryRunSummary>;
export declare function convergeCodexSecurityOutcomes(context: CodexSecurityReviewContext, outcomes: CodexSecurityUnitOutcome[]): CodexSecurityConvergedOutcome[];
export {};