/**
 * The pre-publish redaction gate (product-scope §4.1): secrets travel nowhere
 * without a human seeing the redaction report. Everything here is pure — the
 * CLI wires the decision to a TTY prompt; tests exercise it directly.
 */
export interface RedactionSample {
    kind: string;
    /** the marker with ~40 chars of surrounding, already-redacted context */
    context: string;
}
export interface RedactionReport {
    /** total `[REDACTED:…]` markers across the whole tale */
    total: number;
    /** marker counts by kind, e.g. { "aws-access-key": 1 } */
    counts: Record<string, number>;
    /** up to three sample matches, shown in context */
    samples: RedactionSample[];
}
/** What the redactor caught, everywhere in the composed tale. */
export declare function buildRedactionReport(doc: object): RedactionReport;
export type GateDecision = {
    action: "publish";
} | {
    action: "prompt";
} | {
    action: "refuse";
    message: string;
};
/**
 * `--yes` publishes without a prompt; a TTY gets the interactive preview;
 * anything else (hooks, CI, pipes) is refused so a tale is never published unseen.
 */
export declare function decideGate(opts: {
    yes: boolean;
    tty: boolean;
}): GateDecision;
/**
 * What the tale discloses that no secret scrubber can judge for you. A directory
 * listing naming every client you work for carries no secret pattern at all, and the
 * old preview — which reported only counts — let exactly that reach a public page.
 * These are the strings a human must eyeball, because only a human knows which of
 * them are confidential.
 */
export interface ExposureReport {
    /** absolute paths that live outside the project directory */
    outsidePaths: string[];
    /** external hosts linked or fetched */
    hosts: string[];
    /** email addresses */
    emails: string[];
}
export declare function buildExposureReport(doc: object, opts?: {
    cwd?: string;
}): ExposureReport;