/**
 * Security Scanner Patterns — the `sensitive_path` family
 * @module @skillsmith/core/security/scanner/patterns.sensitive-path
 *
 * SMI-5207: extracted from patterns.ts, which sat 18 lines under the repo's
 * 500-line pre-commit gate (scripts/check-file-length.mjs) before this wave —
 * not enough headroom for the 12 hoisted pattern consts plus the two new
 * severity-gate classification sets below (~42 lines). Same
 * move-the-family-then-re-export convention already used twice in patterns.ts
 * (patterns.jailbreak.ts, SMI-5876; patterns.exec.ts, SMI-6033 Wave 4).
 *
 * Every symbol here is re-exported unchanged from patterns.ts, so every
 * existing import path keeps working AND reference identity is preserved —
 * load-bearing, because scanSensitivePaths() classifies patterns by reference
 * (`pattern === ENV_PATH_PATTERN`, `VALUE_GATED_KEYWORD_PATTERNS.has(pattern)`,
 * and now `PATH_FORM_PATTERNS.has(pattern)` /
 * `VALUE_GATED_ASSIGNMENT_PATTERNS.has(pattern)`).
 *
 * NOTE: a change to SENSITIVE_PATH_PATTERNS or to the severity classification
 * below requires bumping SCANNER_RULESET_VERSION in patterns.ts — see that
 * constant's own doc comment.
 */
export declare const ENV_PATH_PATTERN: RegExp;
export declare const SENSITIVE_PATH_PATTERNS: RegExp[];
export declare const VALUE_GATED_KEYWORD_PATTERNS: ReadonlySet<RegExp>;
/**
 * SMI-5207 (MF-3): the 9 path/filename-form entries. HIGH only when an action
 * verb or shell operator appears within +/-1 line of the match; otherwise
 * MEDIUM — a bare path *mention* is the common case, so evidence is required
 * to escalate. See scanSensitivePaths' hasPathActionContext().
 */
export declare const PATH_FORM_PATTERNS: ReadonlySet<RegExp>;
/**
 * SMI-5207 (MF-4): the 3 keyword-assignment entries. HIGH BY DEFAULT —
 * `keyword: value` is a syntactic credential-assignment shape, rare in
 * innocent prose — downgraded to MEDIUM only on positive prose evidence about
 * the assigned value. See scanSensitivePaths' assignmentHasRealValue().
 *
 * Partition check (guarded by a dedicated test): 1 (ENV) + 9 (PATH_FORM) +
 * 3 (ASSIGNMENT) + 2 (VALUE_GATED_KEYWORD) + 1 (OBSERVE_ONLY_MEDIUM) = 16,
 * total and disjoint. An unclassified future pattern falls through to
 * scanSensitivePaths' fail-CLOSED `else` branch and stays HIGH.
 */
export declare const VALUE_GATED_ASSIGNMENT_PATTERNS: ReadonlySet<RegExp>;
/**
 * SMI-6508 (MF-5): always MEDIUM, never value-gated and never escalated.
 *
 * WHY A NEW CLASS RATHER THAN THE MF-4 SET. Adding the prefixed form to
 * VALUE_GATED_ASSIGNMENT_PATTERNS would make it HIGH-by-default, which blocks
 * installation — there is no allowlist in that path and undoing it costs a
 * package publish. Measured against 66,495 real skill contents in prod: the
 * prefixed form newly matches 259 skills / 418 lines, of which the MF-4 value
 * gate would call 191 "real value" → HIGH, newly blocking 132 skills (0.20% of
 * the corpus, ~975 extrapolated to the full population). Shape analysis put
 * roughly 46% of those 191 in false-positive-looking shapes — multi-word prose,
 * lowercase identifiers, paths — and left 104 genuinely ambiguous.
 *
 * So the detection ships at MEDIUM: the finding becomes visible without costing
 * a single install, and the accumulated real-world findings become the evidence
 * for whether HIGH is justified later. Promoting it is a one-line move into the
 * MF-4 set once that evidence exists.
 *
 * DELIBERATE ASYMMETRY. `DB_PASSWORD=` and `AWS_CREDENTIALS=` already reach
 * HIGH today, because CREDENTIALS_ASSIGN_PATTERN and PASSWORD_ASSIGN_PATTERN
 * carry no `\b` and so have always matched their prefixed forms. Those are
 * grandfathered, not endorsed: their prefixed-form FP rate has never been
 * measured. This entry is MEDIUM because we measured it and the others are not
 * because we have not — that asymmetry reflects the evidence, and levelling it
 * in either direction without measuring first would be the wrong fix. See
 * SMI-6508.
 */
export declare const OBSERVE_ONLY_MEDIUM_PATTERNS: ReadonlySet<RegExp>;
//# sourceMappingURL=patterns.sensitive-path.d.ts.map