import { z } from "zod";
/**
 * Field metadata extracted from a zod env schema. Used by the generators
 * (`.env.example`, Markdown docs, Kubernetes manifests) and the CLI.
 */
export interface EnvField {
    /** The env variable name. */
    key: string;
    /** Coarse-grained primitive type. */
    type: "string" | "number" | "boolean" | "enum" | "unknown";
    /** False when the schema is `.optional()`, `.default(...)`, or `.nullable()`. */
    required: boolean;
    /** Value supplied via `.default(...)`, if any. */
    defaultValue?: unknown;
    /** Allowed values for an enum field. */
    enumValues?: readonly string[];
    /** `.describe(...)` text, with the `@secret` / `@public` tags stripped. */
    description?: string;
    /**
     * True when this field looks like a secret. Determined by:
     *   - An explicit `@secret` tag in the description, or
     *   - A name pattern match (PASSWORD / TOKEN / SECRET / API_KEY / ...).
     *
     * Override by tagging the description with `@public`, or by passing a
     * custom `secretPatterns` array to {@link introspectEnvSchema}.
     */
    secret: boolean;
}
export interface IntrospectOptions {
    /**
     * Regular expressions matched against the env var name. Any match marks
     * the field as a secret unless its description contains `@public`.
     * Defaults to a sensible set covering common secret naming conventions.
     */
    secretPatterns?: RegExp[];
}
/**
 * Patterns that flag a name as secret-looking. Used in two places:
 *
 *   1. {@link introspectEnvSchema} — to auto-tag env vars as secrets
 *      for the K8s Secret manifest generator and `.env.example` masking.
 *   2. The `secret-in-config` lint in {@link checkPerEnvCompleteness}
 *      — to warn when a key lives in `perEnv` (project-controlled)
 *      where operator env vars cannot override it.
 *
 * Patterns use an optional `_?` between words so they match both the
 * SCREAMING_SNAKE convention used for env vars (`PRIVATE_KEY`, `API_KEY`)
 * and the camelCase convention used for config keys (`privateKey`,
 * `apiKey`, `stripeApiKey`).
 */
export declare const DEFAULT_SECRET_PATTERNS: readonly RegExp[];
/**
 * Walk a `z.object({...})` schema and produce {@link EnvField} metadata
 * for every top-level key. Optional / default / nullable wrappers are
 * unwrapped to find the inner primitive.
 *
 * The schema must be a {@link z.ZodObject}. Refinements, transforms,
 * intersections, etc. on the *outer* schema are not introspected; wrap
 * those at the field level instead.
 */
export declare function introspectEnvSchema(schema: z.ZodObject<z.ZodRawShape>, options?: IntrospectOptions): EnvField[];
//# sourceMappingURL=introspect.d.ts.map