import { type ProcessRunner } from "../providers/process.js";
export interface SecretScanReference {
    readonly scan_id: string;
    readonly sha256: string;
    readonly file_name: string;
}
export interface SecretScanResult {
    readonly schema_version: 1;
    readonly scan_id: string;
    readonly ticket_id: string;
    readonly phase: "preflight" | "final";
    readonly scanner: "gitleaks";
    readonly scanner_version: string;
    readonly configuration_sha256: string;
    readonly base_commit: string;
    readonly verified_commit: string;
    readonly scopes: readonly Readonly<{
        scope: "commit-range" | "tracked-worktree" | "evidence" | "outbound";
        input_sha256: string;
        argv_sha256: string;
        passed: boolean;
    }>[];
    readonly passed: boolean;
    readonly created_at: string;
}
export interface SecretScanPolicy {
    readonly schema_version: 1;
    readonly scanner: "gitleaks";
    readonly version: string;
    readonly configuration: "builtin-default";
    readonly redaction_percent: 100;
}
export declare function runSecretScan(options: {
    readonly packageRoot?: string;
    readonly stateRoot: string;
    readonly ticketId: string;
    readonly phase: "preflight" | "final";
    readonly worktreeRoot: string;
    readonly baseCommit: string;
    readonly verifiedCommit: string;
    readonly outbound: unknown;
    readonly env?: NodeJS.ProcessEnv;
    readonly runner?: ProcessRunner;
    readonly clock?: () => string;
}): Readonly<{
    reference: SecretScanReference;
    result: SecretScanResult;
}>;
export declare function readSecretScan(stateRoot: string, reference: SecretScanReference): SecretScanResult;
export declare function readSecretScanPolicy(packageRoot: string): SecretScanPolicy;