/**
 * secret-leak-detector.ts
 *
 * Detects common secret / credential patterns in outbound HTTP request
 * bodies, URLs, and header values.  Used by RawHttpInterceptor to prevent
 * accidental exfiltration of API keys, tokens, or other high-entropy secrets.
 *
 * Pattern catalog (v1):
 *   - OpenAI API keys      sk-...
 *   - Anthropic API keys   sk-ant-...
 *   - Slack tokens         xoxb-..., xoxp-..., xoxa-..., xoxs-...
 *   - GitHub tokens        ghp_..., gho_..., ghs_..., ghr_...
 *   - AWS Access keys      AKIA..., ASIA...
 *   - Generic Bearer token in Authorization header
 *   - Long base64 payloads >= 60 chars (high-entropy bearer tokens, JWTs)
 *   - Long hex strings     >= 40 chars (hashed secrets, signing keys)
 *
 * Each pattern produces a LeakFinding with a sanitized preview (never the
 * raw secret value).
 *
 * @connexum/ai-governance
 */
export type LeakCategory = 'openai-key' | 'anthropic-key' | 'slack-token' | 'github-token' | 'aws-access-key' | 'generic-bearer' | 'high-entropy-base64' | 'high-entropy-hex';
export interface LeakFinding {
    /** Stable pattern identifier. */
    patternId: string;
    /** High-level category of the secret type. */
    category: LeakCategory;
    /** Human-readable label. */
    label: string;
    /** Which surface the pattern fired on. */
    surface: 'body' | 'url' | 'header';
    /** Redacted preview -- never the raw secret. */
    redactedPreview: string;
}
export interface SecretLeakDetectionResult {
    /** Whether any leak pattern was detected. */
    detected: boolean;
    /** All matches found. */
    findings: LeakFinding[];
}
export declare class SecretLeakDetector {
    /**
     * Scan a text string (body, URL, or header value) for secret patterns.
     *
     * @param text    The text to scan.
     * @param surface Which surface this text came from (for audit tagging).
     */
    scan(text: string, surface: 'body' | 'url' | 'header'): SecretLeakDetectionResult;
    /**
     * Scan multiple surfaces in one call.
     *
     * @param body    Raw request body as string (pass '' if none).
     * @param urlStr  Full URL string (query string included for detection).
     * @param headers Record of header name -> value.
     */
    scanAll(body: string, urlStr: string, headers: Record<string, string>): SecretLeakDetectionResult;
}
//# sourceMappingURL=secret-leak-detector.d.ts.map