/**
 * Security scan commands — code/dep/container scanning and secret detection
 */
import { type SarifHealthFinding } from '@monoes/monograph';
import type { Command } from '../types.js';
export declare const SECRET_PATTERNS: Array<{
    pattern: RegExp;
    type: string;
}>;
export type SecretFinding = {
    severity: string;
    type: string;
    location: string;
    description: string;
    rawSeverity?: 'critical' | 'high' | 'medium' | 'low';
};
/**
 * Records what the scanner could NOT look at.
 *
 * Without this the scanner swallowed unreadable directories and stopped at its
 * depth limit, then printed "No secrets found." — an error presented as a clean
 * result. Callers must consult `scanWasIncomplete()` before reporting a clean
 * bill of health.
 */
export interface ScanCoverage {
    /** Directories that could not be listed (permissions, I/O). Real failures. */
    unreadableDirs: string[];
    /** Files that could not be read or stat'd. Real failures. */
    unreadableFiles: string[];
    /** Directories not descended into because the depth limit was reached. */
    depthTruncatedDirs: string[];
    /** Files skipped because they exceed the 1MB per-file cap. */
    oversizedFiles: string[];
    /** Files actually opened and pattern-matched. */
    filesScanned: number;
    /** Directories actually listed. */
    dirsScanned: number;
}
export declare function createScanCoverage(): ScanCoverage;
/** True when some part of the tree was not examined, for any reason. */
export declare function scanWasIncomplete(c: ScanCoverage): boolean;
/** True when the scanner hit a hard failure (not merely a configured limit). */
export declare function scanHadErrors(c: ScanCoverage): boolean;
/** Human-readable lines describing every gap in coverage. Empty when complete. */
export declare function describeScanGaps(c: ScanCoverage): string[];
export declare function findSecretsInDir(dir: string, depthLimit: number, baseDir: string, findings: SecretFinding[], coverage?: ScanCoverage): void;
/**
 * Adapts security-scan findings (file:line-ish locations, flat rawSeverity) into
 * the shape monograph's SARIF exporter expects. Reused rather than reimplemented —
 * see doc/commands/security.md.
 */
export declare function findingsToSarif(findings: Array<{
    type: string;
    location: string;
    description: string;
    rawSeverity: 'critical' | 'high' | 'medium' | 'low';
}>): SarifHealthFinding[];
export declare const scanCommand: Command;
export declare const secretsCommand: Command;
//# sourceMappingURL=security-scan.d.ts.map