import type { EnvField } from "./introspect.js";
/**
 * One mismatch between a live K8s manifest and the env schema.
 *
 * Severity:
 *   - `error` — must fix before deploying (missing required key, secret
 *     accidentally placed in a ConfigMap where it's visible to anyone
 *     with cluster read access, etc.).
 *   - `warning` — likely a problem but not blocking (an extra key in
 *     the live manifest that the schema does not declare, a non-secret
 *     placed inside a Secret).
 */
export interface DiffIssue {
    /** Stable identifier for the issue category. */
    kind: "missing-required" | "secret-in-configmap" | "public-in-secret" | "extra-key";
    severity: "error" | "warning";
    /** Env key name (e.g. "DATABASE_URL"). */
    key: string;
    /** Where the key was found in the live manifest, if applicable. */
    foundIn?: "ConfigMap" | "Secret";
    message: string;
}
export interface DiffReport {
    ok: boolean;
    /** Issues grouped by severity make for nicer text output. */
    issues: DiffIssue[];
    /**
     * Summary counts for quick rendering. `extraKeys` are non-fatal
     * leftovers (e.g. an old key no longer in the schema). `missingRequired`
     * and `secretInConfigMap` block deploys.
     */
    counts: {
        errors: number;
        warnings: number;
    };
    /**
     * Echo of what the diff saw, so JSON consumers don't have to re-parse
     * the YAML to render context.
     */
    observed: {
        configMapKeys: string[];
        secretKeys: string[];
    };
}
export interface ParsedK8sInput {
    configMapKeys: string[];
    secretKeys: string[];
}
/**
 * Parse a YAML blob (multi-document supported) and extract the key
 * names that appear under `data:`/`stringData:` of every ConfigMap
 * and Secret. Other document kinds (Deployment, Service, …) are
 * skipped silently — the diff only cares about ConfigMaps and Secrets.
 *
 * Values are not collected — value-level diff (defaults vs live) is a
 * follow-up; the immediate operational win is on the key/kind axis.
 */
export declare function parseK8sYaml(source: string): ParsedK8sInput;
/**
 * Compare a parsed K8s manifest's keys against the env schema and
 * return a structured report.
 *
 * The four issue categories:
 *
 *   - `missing-required` (error) — schema says required, manifest has
 *     it nowhere. Deploy will boot-crash on validation.
 *   - `secret-in-configmap` (error) — schema flagged this key as a
 *     secret, but it sits in a ConfigMap. Anyone with cluster `get`
 *     on ConfigMaps can read it. Bad.
 *   - `public-in-secret` (warning) — schema doesn't flag this as a
 *     secret, but it lives in a Secret. Harmless but oddly placed.
 *   - `extra-key` (warning) — key in manifest, not declared in schema.
 *     Could be drift or a future-removed var that wasn't cleaned up.
 */
export declare function diffAgainstSchema(parsed: ParsedK8sInput, fields: readonly EnvField[]): DiffReport;
//# sourceMappingURL=diff-k8s.d.ts.map