import type { SanityPlugin } from './types.js';
export interface EnvxAuditOptions {
    /**
     * Scope of the scan.
     *
     * - `'staged'` (default) — scan the staged file list only. Fast,
     *   keeps the commit gate snappy. Doesn't see deletions or files
     *   outside the change set.
     * - `'repo'` — walk the whole repository (excluding ignored dirs).
     *   Equivalent to running `envx audit` from the repo root. Slower,
     *   but catches secrets that were committed before czar was wired
     *   up.
     * - `'paths'` — scan an explicit list of directories.
     */
    readonly scope?: 'staged' | 'repo' | 'paths';
    /** Used when `scope: 'paths'`. Ignored otherwise. */
    readonly paths?: ReadonlyArray<string>;
    /** Extra patterns layered on top of the envx-libs built-ins. */
    readonly extra?: ReadonlyArray<{
        id: string;
        label: string;
        regex: RegExp;
    }>;
    /** Directory or filename ignores added to envx's built-in skip list. */
    readonly ignore?: ReadonlyArray<string>;
    /** Cap on findings to surface (0 = unlimited). Default 50. */
    readonly max?: number;
    /** Severity assigned to every envx-audit finding. Default `'error'`. */
    readonly severity?: 'error' | 'warning';
}
/**
 * Run envx's plaintext-secret scanner (`auditFiles` from
 * `@super-repo/envx-libs`) as a czar sanity plugin.
 *
 * envx's audit catches more credential shapes than czar's built-in
 * `secret-scan` (it ships pattern updates with envx releases) and
 * applies value redaction so the report itself doesn't leak the
 * captured secret. Use this plugin when you've already adopted envx
 * elsewhere — keeps your audit rules in one place.
 *
 * The plugin lazy-loads `@super-repo/envx-libs` on first run, so czar
 * doesn't take a hard dep on envx for users who don't enable it.
 * Missing-dep is reported as a single warning rather than a fatal
 * error so the rest of the commit gate keeps working.
 */
export declare function envxAuditPlugin(opts?: EnvxAuditOptions): SanityPlugin;
//# sourceMappingURL=envx-audit.d.ts.map