/**
 * Secret scanning tool — detects hardcoded secrets in indexed files.
 *
 * Uses @sanity-labs/secret-scan for pattern matching. CodeSift adds:
 * - AST context (which function/class the secret is in)
 * - Confidence demotion for test/doc/placeholder contexts
 * - File-level caching keyed by mtime
 * - Inline allowlist via `// codesift:allow-secret`
 */
import type { CodeSymbol } from "../types.js";
export type SecretSeverity = "critical" | "high" | "medium" | "low";
export interface SecretContext {
    type: "test" | "doc" | "config" | "production";
    symbol_name?: string;
    symbol_kind?: string;
}
export interface SecretFinding {
    rule: string;
    label: string;
    masked_secret: string;
    confidence: "high" | "medium" | "low";
    severity: SecretSeverity;
    file: string;
    line: number;
    context: SecretContext;
}
export interface SecretCacheEntry {
    mtime_ms: number;
    findings: SecretFinding[];
}
export interface ScanSecretsResult {
    findings: SecretFinding[];
    files_scanned: number;
    files_with_secrets: number;
    scan_coverage: "none" | "partial" | "full";
    files_failed?: number;
    partial_failure?: boolean;
}
/**
 * Maps rule IDs to severity. Library confidence is BASE.
 * CodeSift only DEMOTES (test/doc/placeholder → low). Never promotes.
 */
export declare const SEVERITY_MAP: Record<string, SecretSeverity>;
export declare function getSecretCache(): Map<string, Map<string, SecretCacheEntry>>;
export declare function resetSecretCache(): void;
/**
 * Mask a secret for safe display.
 * <8 chars → "****"
 * >=8 chars → first4 + "***" + last4
 */
export declare function maskSecret(secret: string): string;
/** Check if file is a documentation file by extension. */
export declare function isDocFile(filePath: string): boolean;
/**
 * Classify the context of a file for confidence adjustment.
 * - test files → "test"
 * - doc files → "doc"
 * - .env, .yaml, .yml, .json config → "config"
 * - everything else → "production"
 */
export declare function classifyContext(filePath: string): SecretContext["type"];
/**
 * Get severity for a rule ID from the severity map.
 * Unknown rules default to "medium".
 */
export declare function getSeverity(rule: string): SecretSeverity;
/**
 * Check if a finding is allowlisted via inline comment.
 * Looks for `// codesift:allow-secret` on the same line or the line above.
 */
export declare function isAllowlisted(lines: string[], lineNumber: number): boolean;
/**
 * Convert a byte offset in a string to a 1-based line number.
 */
export declare function offsetToLine(content: string, offset: number): number;
/**
 * Enrich a finding with symbol context from the AST index.
 * - Finds the symbol that overlaps the finding's line
 * - Adds symbol_name and kind
 * - Demotes confidence if symbol name looks like a placeholder
 */
export declare function enrichWithSymbolContext(finding: SecretFinding, symbols: CodeSymbol[]): SecretFinding;
/**
 * Scan a single file for secrets.
 * Reads raw file, calls scan(), maps offsets to lines, checks allowlist,
 * enriches with AST context, masks, and caches.
 */
export declare function scanFileForSecrets(filePath: string, relPath: string, repo: string, symbols: CodeSymbol[]): Promise<SecretFinding[]>;
/**
 * Scan all indexed files in a repo for secrets.
 * Returns findings filtered by options.
 */
export declare function scanSecrets(repo: string, options?: {
    file_pattern?: string | undefined;
    min_confidence?: "high" | "medium" | "low" | undefined;
    exclude_tests?: boolean | undefined;
    severity?: SecretSeverity | undefined;
    max_results?: number | undefined;
}): Promise<ScanSecretsResult>;
/** Invalidate cache for a changed file. */
export declare function onFileChanged(repo: string, filePath: string): void;
/** Remove cache entry for a deleted file. */
export declare function onFileDeleted(repo: string, filePath: string): void;
//# sourceMappingURL=secret-tools.d.ts.map