import type { CapabilityProvider } from '../../languages/capabilities/provider';
import type { SecretsResult } from '../../languages/capabilities/types';
/**
 * Per-finding raw value carried alongside the public envelope. Stays
 * out of `SecretsResult` (and therefore out of `SecurityAggregate`,
 * `SecurityReport`, the dashboard, JSON outputs) so the secret value
 * never leaks through the normal reporting surfaces. The only legit
 * consumer is the baseline-side secret-HMAC producer, which immediately
 * HMACs the value and discards it.
 *
 * Lives in this outcome rather than fetched separately so the memoized
 * gitleaks invocation (`gatherGitleaksResult` runs at most once per
 * cwd) covers both the public envelope path and the HMAC path.
 */
export interface GitleaksRawSecret {
    readonly file: string;
    readonly line: number;
    readonly rule: string;
    /** The matched secret value as reported by gitleaks. Process-only;
     *  callers MUST NOT write this to disk, log it, or include it in
     *  any output payload. */
    readonly secret: string;
}
/**
 * Outcome union used by `gatherGitleaksResult`. The capability provider
 * collapses this to `SecretsResult | null`; the Layer 2 reshape in
 * `tools/parallel.ts` reads `unavailable.reason` so the
 * `toolsUnavailable` strings carry install-missing vs parse-failure
 * detail. The `rawSecrets` field is read only by the baseline-side
 * secret-HMAC producer; other consumers ignore it.
 */
export type SecretsGatherOutcome = {
    kind: 'success';
    envelope: SecretsResult;
    suppressedCount: number;
    rawSecrets: ReadonlyArray<GitleaksRawSecret>;
} | {
    kind: 'unavailable';
    reason: string;
};
/**
 * Single source of truth for secret-scanning via gitleaks. Consumed by
 * `gitleaksProvider` (capability dispatcher) and by the Layer 2 legacy
 * reshape in `tools/parallel.ts` — both paths share the memoized
 * per-cwd outcome so gitleaks shells out at most once per analyzer run.
 */
export declare function gatherGitleaksResult(cwd: string): SecretsGatherOutcome;
/**
 * Capability-shaped provider. Register in
 * `src/languages/capabilities/global.ts:GLOBAL_CAPABILITIES` so the
 * dispatcher picks it up via `providersFor(SECRETS)`.
 */
export declare const gitleaksProvider: CapabilityProvider<SecretsResult>;
//# sourceMappingURL=gitleaks.d.ts.map