import type { RepoStack } from "../profile/scan.js";
/**
 * Pre-commit wiring: always run gitleaks against the managed config on every
 * commit, and add a repo-local lint hook ONLY when the repo actually defines a
 * lint command — never reference a script that doesn't exist. Hand-written YAML
 * so the exact `rev`/`args` the blueprint pins survive verbatim.
 */
/** Pinned gitleaks hook revision (the v8 tag the blueprint standardizes on). */
export declare const GITLEAKS_REV = "v8.24.2";
/** gitleaks hook args: verbose output, scoped to the aih-managed config. */
export declare const GITLEAKS_ARGS: string[];
/** The aih-ownership marker in the generated config header (user files lack it). */
export declare const PRECOMMIT_MARKER = "managed by aih guardrails";
/** Exact first line required before aih treats an existing pre-commit config as generated. */
export declare const PRECOMMIT_HEADER = "# .pre-commit-config.yaml \u2014 local commit gate (managed by aih guardrails)";
/** The gitleaks `repos:` list item (2-space indent), reused by the config + merge doc. */
export declare function gitleaksRepoBlock(): string[];
/** Render `.pre-commit-config.yaml` — gitleaks always, lint hook only if real. */
export declare function preCommitConfigYaml(stack?: RepoStack): string;
/**
 * Guidance shown when a USER-authored `.pre-commit-config.yaml` already exists:
 * aih leaves it untouched (never clobbers a team's hooks) and hands over the exact
 * gitleaks block to paste under their `repos:` list.
 */
export declare function gitleaksMergeSnippet(): string;