export interface ScanArgs {
    readonly path?: string;
    readonly verbose?: boolean;
    readonly "no-color"?: boolean;
    readonly color?: string;
    readonly "rules-dir"?: string;
    readonly format?: string;
    readonly "fail-on"?: string;
    readonly baseline?: string;
    readonly "no-baseline"?: boolean;
    readonly "diff-only"?: boolean;
    readonly "diff-base"?: string;
    readonly history?: boolean;
    readonly since?: string;
    readonly "verify-secrets"?: boolean;
    readonly config?: string;
    readonly "no-config"?: boolean;
    readonly "strict-suppressions"?: boolean;
    readonly "min-parse-coverage"?: string;
    readonly "include-tests"?: boolean;
    readonly provider?: string;
    readonly "severity-class"?: string;
    readonly exclude?: string;
    readonly include?: string;
    readonly "no-trivia"?: boolean;
    readonly "no-update-notifier"?: boolean;
}
export declare function runScanCommand(args: ScanArgs): Promise<number>;
export declare const scanCommand: import("citty").CommandDef<{
    readonly path: {
        readonly type: "positional";
        readonly required: false;
        readonly description: "Project root (default: .)";
        readonly default: ".";
    };
    readonly verbose: {
        readonly type: "boolean";
        readonly alias: "v";
        readonly description: "Verbose output.";
    };
    readonly "no-color": {
        readonly type: "boolean";
        readonly description: "Disable color and OSC-8 hyperlinks.";
    };
    readonly color: {
        readonly type: "string";
        readonly description: "When to colorize: always | never | auto (default). Use 'always' to force color through a pipe.";
    };
    readonly "rules-dir": {
        readonly type: "string";
        readonly description: "Override the bundled rule pack location (dev-only).";
    };
    readonly format: {
        readonly type: "string";
        readonly description: "Output format: text | json | sarif";
    };
    readonly "fail-on": {
        readonly type: "string";
        readonly description: "Severity threshold: critical | high | medium | low";
    };
    readonly baseline: {
        readonly type: "string";
        readonly description: "'write' to capture; auto-read otherwise";
    };
    readonly "no-baseline": {
        readonly type: "boolean";
        readonly description: "Disable baseline reading";
    };
    readonly "diff-only": {
        readonly type: "boolean";
        readonly description: "Scan only files changed vs base ref (CLI-08)";
    };
    readonly "diff-base": {
        readonly type: "string";
        readonly description: "Override auto-detected base ref";
    };
    readonly history: {
        readonly type: "boolean";
        readonly description: "Scan the git history for leaked secrets, INCLUDING files deleted before HEAD (default scans the worktree only). Off by default; bounded to the last 1000 commits unless --since is given.";
    };
    readonly since: {
        readonly type: "string";
        readonly description: "Bound the --history walk to a git ref (e.g. 'v1.0.0') or a date (e.g. '2026-01-01'). Requires --history.";
    };
    readonly "verify-secrets": {
        readonly type: "boolean";
        readonly description: "Live-verify leaked API-key-class secrets (Stripe/GitHub) by a read-only call to the secret's own provider. Paid (team); needs HOOKWARDEN_TOKEN. Signing secrets (whsec_) are always 'unverified'. Off by default.";
    };
    readonly config: {
        readonly type: "string";
        readonly description: "Path to hookwarden.config.yaml (overrides walk-up discovery)";
    };
    readonly "no-config": {
        readonly type: "boolean";
        readonly description: "Bypass config-file discovery";
    };
    readonly "no-trivia": {
        readonly type: "boolean";
        readonly description: "Suppress the rotating webhook-security tips that appear on stderr during long scans. Already auto-disabled in CI / non-TTY / NO_COLOR.";
    };
    readonly "no-update-notifier": {
        readonly type: "boolean";
        readonly description: "Suppress the 'update available' notice that appears when a newer hookwarden is on npm. Already auto-disabled in CI / non-TTY / NO_COLOR.";
    };
    readonly "strict-suppressions": {
        readonly type: "boolean";
        readonly description: "Promote stale suppressions to errors (D-67)";
    };
    readonly "min-parse-coverage": {
        readonly type: "string";
        readonly description: "Minimum parse-coverage ratio 0..1 (default 0.95)";
    };
    readonly "include-tests": {
        readonly type: "boolean";
        readonly description: "Scan test/fixture/mock paths too. Excluded by default — production routes rarely live in test/, tests/, __tests__/, spec/, fixtures/, mocks/, *.test.*, *.spec.*, test_*.py, *_test.py.";
    };
    readonly provider: {
        readonly type: "string";
        readonly description: "Comma-separated provider filter (e.g., 'stripe' or 'stripe,github'). When set, only rules for the listed providers run — useful for phased rollout. Valid: stripe, github, shopify, slack, twilio, square.";
    };
    readonly "severity-class": {
        readonly type: "string";
        readonly description: "Restrict the scan to a rule-class group. 'production-bypass' = the classes where a forged or replayed request would be accepted in production (verification missing, defeated, bypassable, or replay-able); excludes secret-leak and positive-signal rules.";
    };
    readonly exclude: {
        readonly type: "string";
        readonly description: "Comma-separated gitignore-style globs to exclude from the scan (e.g., 'packages/legacy/**,vendor/**'). Applied on top of .gitignore + default test-fixture exclusions.";
    };
    readonly include: {
        readonly type: "string";
        readonly description: "Comma-separated gitignore-style globs to scope the scan to (e.g., 'packages/api/**'). When set, only matching files are scanned.";
    };
}>;
//# sourceMappingURL=scan.d.ts.map