import type { LintRule } from "@intentius/chant/lint/rule";
/**
 * FLY004: No secret literals in machine config
 *
 * Flags secret values written inline in config (e.g. an env value under a
 * credential-looking key). Secrets belong in `secrets` (apply-only) or a
 * reference. The heuristic is conservative: it fires only when the property
 * name looks like a credential AND the value is a plain string literal that is
 * not a reference/placeholder, so a `secrets` reference (an identifier or
 * `$FOO` placeholder) is not flagged.
 */
export declare const noSecretLiteralsRule: LintRule;
//# sourceMappingURL=no-secret-literals.d.ts.map