/**
 * Secret scanning utilities using TruffleHog.
 *
 * Provides functions for scanning content for leaked credentials and secrets.
 * Uses TruffleHog CLI under the hood for detection and verification.
 */
/**
 * Result from TruffleHog secret detection.
 */
export interface SecretFinding {
    /** The type of detector that found the secret (e.g., "AWS", "Stripe", "GitHub") */
    detectorType: string;
    /** The name of the detector */
    detectorName: string;
    /** Whether the secret was verified as active */
    verified: boolean;
    /** The raw secret value (may be redacted) */
    raw: string;
    /** Redacted version of the secret */
    redacted: string;
    /** Line number where the secret was found (if available) */
    line?: number;
    /** Additional metadata about the secret */
    extraData?: Record<string, unknown>;
    /** Source metadata */
    sourceMetadata?: {
        file?: string;
        line?: number;
    };
}
/**
 * Options for secret scanning.
 */
export interface SecretScanOptions {
    /** Timeout in milliseconds (default: 5000) */
    timeout?: number;
    /** Only return verified (confirmed active) secrets (default: false - returns all findings) */
    verifiedOnly?: boolean;
}
/**
 * Result of a secret scan operation.
 */
export interface SecretScanResult {
    /** Whether the scan completed successfully */
    success: boolean;
    /** List of detected secrets */
    findings: SecretFinding[];
    /** Error message if scan failed */
    error?: string;
    /** Whether any verified secrets were found */
    hasVerifiedSecrets: boolean;
    /** Whether any secrets (verified or not) were found */
    hasSecrets: boolean;
    /** The original content with secrets replaced by redacted versions */
    redactedContent: string;
}
/**
 * Redacts secrets in content by replacing raw values with redacted versions.
 *
 * Replaces each detected secret's raw value with its redacted form.
 * Secrets are processed longest-first to handle overlapping matches correctly.
 *
 * @param content - The original content containing secrets
 * @param findings - Array of secret findings from TruffleHog
 * @returns Content with all detected secrets redacted
 */
export declare function redactSecrets(content: string, findings: SecretFinding[]): string;
/**
 * Runs TruffleHog CLI using stdin and returns parsed findings.
 *
 * Uses TruffleHog's built-in detectors for common secret types (Stripe, GitHub,
 * AWS, private keys, etc.) without custom configuration.
 *
 * @param content - Content to scan for secrets (piped to stdin)
 * @param timeout - Timeout in milliseconds
 * @param verifiedOnly - Whether to only return verified secrets
 * @returns Promise resolving to array of SecretFinding objects
 */
export declare function runTrufflehog(content: string, timeout: number, verifiedOnly: boolean): Promise<SecretFinding[]>;
/**
 * Checks if TruffleHog is available on the system.
 *
 * @returns Promise resolving to true if TruffleHog is installed and accessible
 */
export declare function isTrufflehogAvailable(): Promise<boolean>;
/**
 * A reusable secret redactor that can perform fast synchronous redaction.
 *
 * Use this when you need to redact secrets from multiple pieces of content
 * using the same set of findings (e.g., redacting LLM responses based on
 * secrets found in the input prompt).
 *
 * @example
 * ```typescript
 * // Scan input once
 * const result = await scanContentForSecrets(userPrompt);
 * const redactor = new SecretRedactor(result.findings);
 *
 * // Redact multiple outputs synchronously
 * const safeResponse = redactor.redact(llmResponse);
 * const safeToolOutput = redactor.redact(toolResult);
 * ```
 */
export declare class SecretRedactor {
    private sortedFindings;
    /**
     * Creates a new SecretRedactor with the given findings.
     *
     * @param findings - Secret findings to use for redaction
     */
    constructor(findings: SecretFinding[]);
    /**
     * Redacts secrets from the given content synchronously.
     *
     * @param content - The content to redact secrets from
     * @returns Content with secrets replaced by redacted versions
     */
    redact(content: string): string;
    /**
     * Redacts secrets from any value (string, object, or array).
     *
     * Recursively processes objects and arrays, redacting any string values.
     *
     * @param value - The value to redact secrets from
     * @returns Value with secrets redacted from all string content
     */
    redactDeep(value: unknown): unknown;
    /**
     * Returns true if this redactor has any findings to redact.
     */
    hasFindings(): boolean;
    /**
     * Returns the number of findings this redactor has.
     */
    get findingCount(): number;
}
export declare function formatSecretFindings(findings: SecretFinding[]): string;
//# sourceMappingURL=secret-scanner.d.ts.map