import type { CheckCode } from "../internals/verify.js";
/** What a repository scan turned up: plaintext secret files + a `secrets/` dir. */
export interface SecretScan {
    /** Relative paths (POSIX separators) of `.env` / `.env.*` files that are not examples. */
    envFiles: string[];
    /** Relative path of a root-level `secrets/` credential directory, if present. */
    secretDirs: string[];
    /** Convenience union of every flagged path, sorted, for warning text. */
    matches: string[];
}
/**
 * Scan `root` for plaintext secret material — `.env` files shallow plus one
 * level deep (excluding `.env.example` / `.env.sample`), and a credential
 * directory named `secrets/` at the repo ROOT only. Nested directories named
 * `secrets` (e.g. `src/secrets`, `tests/secrets`) are code, not secret stores,
 * and are deliberately ignored — matching the root-anchored `Read(./secrets/**)`
 * deny rule. Pure: reads the filesystem, touches no network, mutates nothing;
 * returns repo-relative POSIX paths so results feed deterministically into deny
 * rules and warning docs.
 */
export declare function scanSecrets(root: string, opts?: {
    accept?: (rel: string) => boolean;
}): SecretScan;
/** One secret-scan finding inside or at a config file boundary (not a `.env`). */
export interface ConfigSecretHit {
    /** Repo-relative POSIX path of the offending config file. */
    file: string;
    /** Nearest JSON key for the matched value (best-effort; "" for a raw-text match). */
    key: string;
    /** What matched — a known provider token shape, secret-looking key literal, or unsafe path. */
    kind: string;
    /** Stable verification code to emit for this finding. Defaults to `mcp.hardcoded-secret`. */
    code?: Extract<CheckCode, "mcp.config-invalid" | "mcp.hardcoded-secret">;
}
/**
 * Repo-relative MCP config files aih writes or knows about. The sanctioned way to
 * carry a credential here is an env reference (`"${TOKEN}"`), never a literal — so
 * these files need a CONTENT scan. The filename-based {@link scanSecrets} cannot see
 * a token pasted INTO a config file, only a `.env` file sitting beside it; this
 * closes that hole for the MCP surface.
 */
export declare const MCP_CONFIG_FILES: readonly string[];
export interface ExternalMcpConfigFile {
    /** Redacted/display path, usually the registry's `~/...` path. */
    file: string;
    /** Absolute path to inspect. */
    absPath: string;
}
/**
 * Scan known MCP config files for hardcoded secrets or unsafe file boundaries — a
 * provider token shape anywhere, a literal (non-`${ENV}`) value under a
 * secret-looking key, or a path that cannot be read as a repo-contained regular
 * file. Pure: reads only contained regular files, returns repo-relative hits, and
 * NEVER includes the secret value itself (only file + key + match kind). Malformed
 * JSON falls back to raw credential-shape scans so a broken file still cannot hide
 * a token.
 */
export declare function scanConfigSecrets(root: string, files?: readonly string[]): ConfigSecretHit[];
export declare function scanExternalConfigSecrets(files: readonly ExternalMcpConfigFile[]): ConfigSecretHit[];