import type { SanityPlugin } from './types.js';
export interface SecretPattern {
    readonly name: string;
    readonly pattern: RegExp;
}
/**
 * Built-in patterns for common credential formats. Conservative on
 * purpose — false positives are worse than false negatives in a commit
 * gate. Users with org-specific tokens can pass `extra:` to layer
 * patterns on top.
 */
export declare const BUILT_IN_PATTERNS: ReadonlyArray<SecretPattern>;
export interface SecretScanOptions {
    /** Extra patterns to layer on top of the built-ins. */
    readonly extra?: ReadonlyArray<SecretPattern>;
    /** Replace the built-in patterns entirely (rare — usually you want `extra` instead). */
    readonly patterns?: ReadonlyArray<SecretPattern>;
}
/**
 * Scan staged file content (per-line) for known credential shapes —
 * AWS, GitHub, Stripe, Anthropic, OpenAI, JWT, PEM blocks, etc.
 *
 * Findings on `.env*` files are upgraded to `error` because committed
 * env files containing matching shapes are almost certainly leaks; on
 * other files (config, source) the same shape is more likely to be
 * test-fixtures or examples and gets `warning`.
 *
 * @deprecated Folded into `secretsPlugin`. Still exported so power
 * users can compose a custom plugin set without bringing in the full
 * consolidated check.
 */
export declare function secretScanPlugin(opts?: SecretScanOptions): SanityPlugin;
//# sourceMappingURL=secret-scan.d.ts.map