import type { z } from "zod";
import type { SettingsLoader } from "./define-settings.js";
export interface PerEnvIssue {
    /** Which `perEnv` branch the issue belongs to (e.g. `"prod"`). */
    env: string;
    /** Dot-separated path inside the config object, or env key for env issues. */
    path: string;
    /** Severity of the issue. */
    severity: "error" | "warning";
    /** Human-readable message. */
    message: string;
    /** Internal kind, useful for filtering in custom reporters. */
    kind: "placeholder" | "empty-string" | "missing-required-env" | "missing-branch" | "todo" | "secret-in-config";
}
export interface CheckPerEnvOptions {
    /**
     * Restrict the check to a subset of environments. Defaults to every key
     * in `perEnv`.
     */
    envs?: readonly string[];
    /**
     * Required environment variables that must be supplied by the runtime
     * (typically secrets that don't have schema defaults). The checker
     * reports them as `missing-required-env` for environments where they
     * aren't present in the supplied `envValues` map.
     *
     * Defaults to every required field in the env schema that has no
     * `.default(...)`.
     */
    requiredEnvKeys?: readonly string[];
    /**
     * Runtime env values per branch (e.g. from CI secrets or `.env.<env>`
     * files), used to satisfy `requiredEnvKeys`. Pass an empty map to flag
     * every required env key as missing.
     */
    envValues?: Record<string, Record<string, string | undefined>>;
    /**
     * Regexes that match placeholder values in the layered config (e.g.
     * `TODO`, `FIXME`, `REPLACE_ME`). Defaults cover common conventions.
     */
    placeholderPatterns?: readonly RegExp[];
    /**
     * When true, flag empty strings in the layered config as warnings.
     * Defaults to true.
     */
    flagEmptyStrings?: boolean;
    /**
     * Run the design-time lint pass that catches values placed in the
     * wrong layer (e.g. a secret-looking key inside `perEnv` where
     * operator env vars cannot override it). Defaults to true.
     */
    lint?: boolean;
    /**
     * Regexes matched against perEnv key paths during lint. A match
     * raises a `secret-in-config` warning suggesting the value belongs
     * in `envSchema`. Defaults to the same patterns the introspector
     * uses for secret detection.
     */
    secretKeyPatterns?: readonly RegExp[];
}
export interface PerEnvCompletenessReport {
    /** True iff there are no `severity: "error"` issues. */
    ok: boolean;
    /** Every issue discovered, in deterministic order. */
    issues: PerEnvIssue[];
    /** Convenience: issue count grouped by env. */
    countsByEnv: Record<string, {
        errors: number;
        warnings: number;
    }>;
}
/**
 * Verify that every per-env branch of a settings loader is filled in
 * enough to actually run that environment. Use this as a CI gate
 * ("don't deploy if `perEnv.prod.bucket` is still `TODO-prod-bucket`").
 *
 * The check covers two classes of issues:
 *   1. **Config placeholders** — values in the layered `defaults + perEnv`
 *      output that match a placeholder pattern, or are empty strings.
 *   2. **Missing required env** — env vars required by the schema (no
 *      default, not `.optional()`) that aren't present in `envValues[env]`.
 */
export declare function checkPerEnvCompleteness<TSchema extends z.ZodObject<z.ZodRawShape>, TConfig extends object, TSettings extends object>(loader: SettingsLoader<TSchema, TConfig, TSettings>, options?: CheckPerEnvOptions): PerEnvCompletenessReport;
//# sourceMappingURL=check-per-env.d.ts.map