/**
 * Shared secret pattern and key name registry.
 *
 * Single source of truth for secret detection across:
 * - governance.ts (ToolGovernor redaction)
 * - secret-scanner.ts (file/dir scanning)
 * - host.ts (runtime sanitization)
 *
 * Eliminates inline duplicates in governance.ts and secret-scanner.ts.
 */
export interface SecretPattern {
    /** Unique name for this pattern */
    name: string;
    /** Regex to detect the secret in text */
    pattern: RegExp;
    /** Category for reporting */
    category: string;
    /** Severity level */
    severity: 'low' | 'medium' | 'high' | 'critical';
}
export interface SecretKeyEntry {
    /** The canonical key name (lowercase, no dashes/underscores) */
    key: string;
    /** Known aliases (e.g. "api-key" for "apikey") */
    aliases: string[];
    /** Category for reporting */
    category: string;
}
/**
 * Default secret patterns for runtime redaction and scanning.
 *
 * governance.ts DEFAULT_SECRET_PATTERNS (14 patterns) replaced by this.
 * secret-scanner.ts BUILTIN_PATTERNS remain separate (they use structured
 * ScanPattern with id/severity/scanMode). This registry provides the
 * runtime-fast subset used by ToolGovernor.redactSecrets().
 */
export declare const SECRET_PATTERNS: SecretPattern[];
/**
 * Flat set of all secret key names (canonical + aliases).
 * Used for O(1) lookup in arg sanitization.
 */
export declare const SECRET_KEY_NAMES: ReadonlySet<string>;
/**
 * Normalize a rule/arg key to its canonical form.
 * Strips dashes, underscores, lowercases, then looks up in canonical map.
 *
 * Examples:
 *   "api-key" → "apikey"
 *   "API_KEY" → "apikey"
 *   "access_token" → "token"
 *   "clientSecret" → "secret"
 */
export declare function normalizeRuleKey(key: string): string;
/**
 * Check if a key is a secret key (O(1) lookup).
 */
export declare function isSecretKey(key: string): boolean;
/**
 * Get all entries (for reporting/config UI).
 */
export declare function getSecretKeyEntries(): readonly SecretKeyEntry[];
