/**
 * Credential over-authority detection for the delivery/authority readiness
 * dimension — ship blocker B3 (PRD #1739, #1896).
 *
 * B3 asks whether the credential that ships carries only the authority it needs.
 * The question is answered offline from what the workflows *declare*, because a
 * credential's blast radius is a property of the declaration, not of any
 * particular run: a token granted `write-all` is over-authorized whether or not
 * today's run happened to use it.
 *
 * Four declarations are treated as material over-authority: inherited secrets
 * (`secrets: inherit` hands a called workflow everything), `write-all`/`read-all`
 * blanket permission grants, a job that uses the repository token with no
 * `permissions` block at all (so it takes the repository default rather than a
 * stated minimum), and static long-lived deployment credentials in jobs that
 * should use a scoped or federated credential instead. Each is provable from
 * the declaration alone.
 *
 * A fifth signal — one secret NAME appearing under several environments — is
 * reported as an *observation*, never a blocker: environment secrets are meant
 * to reuse one name per environment, and repository-scope versus
 * environment-scope is not decidable from YAML.
 *
 * It lives beside the delivery producer rather than inside it for file-size
 * hygiene — the same split the blocker gate and journey wiring already use.
 * @module cli/doctor-readiness-credentials
 */
import type { ParsedWorkflow } from "./doctor-readiness-workflows.js";
/** The credential half of a delivery/authority assessment. */
export interface CredentialFindings {
    /** Provable over-authority: each line stands blocker B3. */
    readonly violations: readonly string[];
    /** Observations that are real but not decidable offline; never blocking. */
    readonly informational: readonly string[];
}
/**
 * Detect credential over-authority across the repository's workflows.
 *
 * Violations are ordered by consequence: blanket grants and inherited secrets
 * first (they are unbounded), then narrower over-authority. Anything the
 * workflow files cannot settle lands in `informational`, which carries no
 * `blocker` key and therefore can never flip a verdict.
 * @param workflows - Parsed workflows
 * @returns Violations and informational observations
 */
export declare function detectCredentialFindings(workflows: readonly ParsedWorkflow[]): CredentialFindings;
//# sourceMappingURL=doctor-readiness-credentials.d.ts.map