/** Fail-closed repository-wide credential scan performed before provider access. */
import { type SecretKind } from "../../memory/context.ts";
export interface ProjectSecretFindingV1 {
    path: string;
    kind: SecretKind;
    line: number;
}
export interface ProjectSecretScanOptions {
    maxFiles?: number;
    maxBytes?: number;
    maxFindings?: number;
}
export interface ProjectSecretScanResultV1 {
    filesScanned: number;
    bytesScanned: number;
    symlinksSkipped: number;
    findings: ProjectSecretFindingV1[];
}
export declare class ProjectSecretScanError extends Error {
    readonly code: "INVALID_ROOT" | "PARTIAL_SCAN" | "SECRET_DETECTED";
    readonly findings: readonly ProjectSecretFindingV1[];
    constructor(code: ProjectSecretScanError["code"], message: string, findings?: readonly ProjectSecretFindingV1[]);
}
/**
 * Scan first-party regular files, including ignored/untracked fixtures and
 * logs. Dependency stores and VCS/tool internals are excluded because they are
 * neither provider context nor first-party source.
 */
export declare function scanProjectForSecrets(rootInput: string, options?: ProjectSecretScanOptions): Promise<ProjectSecretScanResultV1>;
//# sourceMappingURL=secret-scan.d.ts.map