/**
 * A cleartext-secret occurrence found while scanning produced test artifacts.
 * `entry` is set when the hit is inside a zip (e.g. a Playwright `trace.zip`
 * resource body); otherwise the secret was found directly in `file`.
 */
export interface ArtifactSecretHit {
    readonly file: string;
    readonly entry?: string;
    readonly secret: string;
}
/**
 * Recursively scans a produced-artifacts directory for cleartext `secrets`,
 * looking *inside* `trace.zip` archives (including their hashed `resources/*`
 * network-body entries) as well as plain files (logs, HAR, `error-context.md`,
 * screenshots, video). Intended as a regression guard: after redaction the
 * returned list must be empty for both passing and failing runs.
 *
 * Only catches secrets known verbatim (e.g. the account password from config).
 * For per-run-minted credentials whose value is not known in advance (the Okta
 * session cookie, `okta-token-storage` tokens) use
 * {@link scanArtifactsForUnredactedSecrets}.
 *
 * @param dir - Root artifacts directory to walk.
 * @param secrets - Cleartext values that must not appear anywhere.
 * @returns {Promise<Array<ArtifactSecretHit>>} Every occurrence found.
 */
export declare const scanArtifactsForSecrets: (dir: string, secrets: ReadonlyArray<string>) => Promise<Array<ArtifactSecretHit>>;
/**
 * A *structural* leak: a value that should have been redacted (it sits under a
 * sensitive JSON key, a URL-encoded sensitive param, or a browser cookie
 * `value`) but is not `***`. Needs no verbatim secret, so it catches
 * per-run-minted credentials whose value CI cannot know in advance.
 */
export interface StructuralSecretHit {
    readonly file: string;
    readonly entry?: string;
    readonly key: string;
    readonly kind: "json" | "url" | "cookie";
}
/**
 * Recursively scans a produced-artifacts directory for *structural* leaks —
 * sensitive values that were not reduced to `***`. Unlike
 * {@link scanArtifactsForSecrets} it needs no verbatim secret, so it catches the
 * Okta session cookie and `okta-token-storage` tokens replayed on the `login()`
 * cache-hit path, whose values are minted per run. Intended as a CI guard
 * alongside the verbatim scan: the returned list must be empty after redaction.
 *
 * @param dir - Root artifacts directory to walk.
 * @returns {Promise<Array<StructuralSecretHit>>} Every unredacted sensitive value found.
 */
export declare const scanArtifactsForUnredactedSecrets: (dir: string) => Promise<Array<StructuralSecretHit>>;