import type { SanityPlugin } from './types.js';
import { type SecretPattern } from './secret-scan.js';
/**
 * Single plugin covering every "did the user stage something that
 * shouldn't ship?" check that used to be split across four plugins:
 * `envFilePlugin`, `privateKeyFilePlugin`, `secretScanPlugin`, and
 * `standardEnvAuditPlugin`.
 *
 * Why one plugin instead of four:
 *
 *   - Same goal (block credential leaks), four config knobs to tune.
 *   - Sub-checks share state — encryption detection on a `.env` file
 *     should suppress later content-scan findings on the same file
 *     (no point flagging `encrypted:abc…` as a non-placeholder).
 *   - Single header summary line is more readable than four separate
 *     ones for one logical check.
 *
 * The four sub-check ids — `env-file`, `private-key-file`, `secret`,
 * `env-plaintext` — are preserved on each finding so verbose output and
 * downstream parsers stay backwards-compatible. The plugin's `name` is
 * `secrets`; that's the single line you see in the header.
 *
 * ## Encryption-aware env-file handling (new)
 *
 * The legacy `envFilePlugin` blocks every `.env*` file unless its
 * basename is on a static allowlist (default: `.env.example`,
 * `.env.template`, `.env.sample`, `.env.dist`). That forced consumers
 * with envx-style encrypted env files to maintain a hand-written
 * allowlist for `vault/.env`, `vault/.env.prod`, etc.
 *
 * `secretsPlugin` instead inspects content: a file with an
 * `(ENVX|DOTENV)_PUBLIC_KEY*` header AND only `encrypted:` (or empty)
 * values is presumed safely encrypted and passes silently. A file with
 * mixed plaintext values still gets flagged. The static allowlist is
 * kept as an additional escape hatch for templates and intentional
 * shared files.
 */
/**
 * Stable ids of the four sub-checks the consolidated plugin runs.
 * Match the `check` field on findings so users see the same string in
 * `disable` config and in failure output.
 */
export type SecretsSubCheck = 'env-file' | 'private-key' | 'secret' | 'env-plaintext';
export interface SecretsPluginOptions {
    /**
     * Filename basenames that bypass the env-file block regardless of
     * content. Default: the conventional templates. Append to extend;
     * pass an empty array to rely entirely on encryption detection.
     */
    readonly envFileAllowlist?: ReadonlyArray<string>;
    /**
     * Sub-checks to skip. Pass any of `'env-file'`, `'private-key'`,
     * `'secret'`, `'env-plaintext'`. The strings match the `check` field
     * on findings, so when you see a false positive you copy the id
     * straight from the failure into here.
     *
     * ```ts
     * secretsPlugin({ disable: ['private-key'] })            // commit *.pem fixtures
     * secretsPlugin({ disable: ['secret', 'env-plaintext'] })// fixtures with fake creds
     * ```
     */
    readonly disable?: ReadonlyArray<SecretsSubCheck>;
    /** Extra credential patterns layered on top of the built-ins. */
    readonly extraPatterns?: ReadonlyArray<SecretPattern>;
    /**
     * Replace the credential-pattern set entirely. Rare — usually you
     * want `extraPatterns` instead so the built-ins still run.
     */
    readonly patterns?: ReadonlyArray<SecretPattern>;
    /**
     * Override the env-plaintext key-name heuristic. Default matches
     * the `SECRET / TOKEN / PASSWORD / API_KEY / PRIVATE_KEY /
     * ACCESS_KEY / AUTH / CREDENTIAL` family.
     */
    readonly envSecretKeyPattern?: RegExp;
    /** Min value length to count as a non-placeholder env secret. Default 12. */
    readonly envSecretMinLength?: number;
}
export declare function secretsPlugin(opts?: SecretsPluginOptions): SanityPlugin;
//# sourceMappingURL=secrets.d.ts.map