/**
 * The `tryassay hook-run` runner — invoked by Claude Code's PostToolUse hook
 * on every Write/Edit. It reads the hook payload on stdin, verifies the edited
 * file locally (formal-only, no API key, no network), and prints an advisory
 * summary.
 *
 * PRODUCT CONSTRAINTS (from the capsule):
 *   • ADVISORY, never blocking — always exit 0, no matter what.
 *   • FAST — local formal/deterministic pass only by default (the API path is
 *     opt-in because it costs money per edit).
 *   • FAIL-OPEN — an unreadable file, malformed payload, or any thrown error
 *     produces NO output and exit 0. A hook that wedges the editor is a
 *     reputation fire.
 */
export interface HookFinding {
    line: number;
    severity: string;
    detail: string;
    source: string;
}
/** Read the whole payload from a stream (stdin). */
export declare function readStdin(stream: NodeJS.ReadableStream): Promise<string>;
/** Extract the edited file path from a PostToolUse payload. Null if absent. */
export declare function filePathFromPayload(raw: string): string | null;
/**
 * Run the local, no-key verification pass over one file's content. Combines
 * the existing claimless scanner with the Sentinel security ports (whose
 * detect() functions are pure presence-of-defect detectors — no claim needed).
 * Returns [] for a language we don't scan.
 */
export declare function verifyFileContent(content: string, filePath: string): HookFinding[];
/** Render the advisory block Claude Code surfaces. Empty string = say nothing. */
export declare function formatAdvisory(filePath: string, findings: HookFinding[]): string;
/**
 * The runner entry point. Always resolves; NEVER throws, NEVER exits non-zero.
 * Returns the advisory text (also written to stderr so Claude Code surfaces it
 * without polluting stdout tool results).
 */
export declare function runHook(stdin: NodeJS.ReadableStream, stderr: NodeJS.WritableStream): Promise<void>;