/**
 * Enterprise secret-scanning rules layered on top of gitleaks' default ruleset.
 *
 * `[extend] useDefault = true` keeps the upstream rules (hundreds of provider
 * patterns) and adds the enterprise-specific detections the blueprint calls out:
 * AWS access-key IDs and any PEM private-key header. The allowlist intentionally
 * exempts only LOCAL scratch directories — never source — so a developer's
 * throwaway `.var/` cache can hold a fixture token without tripping the gate.
 */
/** AWS access-key ID (long-term `AKIA…` and temporary `A3T…`). */
export declare const AWS_KEY_REGEX = "(?i)(A3T[A-Z0-9]{16}|AKIA[0-9A-Z]{16})";
/** Any PEM private-key block header (RSA/EC/OPENSSH/DSA/…). */
export declare const PRIVATE_KEY_REGEX = "-----BEGIN [A-Z]+ PRIVATE KEY-----";
/** Local, non-synced scratch roots exempted from scanning (root-anchored regexes, never source dirs). */
export declare const SCRATCH_ALLOWLIST: string[];
/** Render `.gitleaks.toml` — default rules + enterprise regex + scratch allowlist. */
export declare function gitleaksToml(): string;