import { EventEmitter } from "node:events";
import { SECRET_KEY_NAMES } from "./shared-secret-registry.js";
/** Severity of a detected secret */
export declare enum SecretSeverity {
    /** Confirmed credential — immediate risk (AWS keys, tokens, passwords) */
    CRITICAL = "critical",
    /** High-confidence secret pattern (API keys, JWTs, private keys) */
    HIGH = "high",
    /** Possible secret (generic env vars, hex strings) */
    MEDIUM = "medium",
    /** Low-confidence / informational (short tokens, partial matches) */
    LOW = "low"
}
/** Scanning mode controls depth vs speed tradeoff */
export declare enum ScanMode {
    /** Fast — common patterns only, no file I/O */
    QUICK = "quick",
    /** Balanced — all patterns, file scanning, context analysis */
    DEEP = "deep",
    /** Thorough — all patterns, entropy analysis, aggressive heuristics */
    PARANOID = "paranoid"
}
/** A single secret detection pattern */
export interface SecretPatternDef {
    /** Unique pattern identifier */
    name: string;
    /** Human-readable description */
    description: string;
    /** Regex pattern to match (must be global for counting) */
    pattern: RegExp;
    /** Replacement string for redaction */
    replacement: string;
    /** Severity level */
    severity: SecretSeverity;
    /** Pattern category for grouping */
    category: string;
    /** Whether this pattern is enabled */
    enabled: boolean;
    /** Scan mode minimum — only active in this mode or higher */
    minMode: ScanMode;
}
/** A detected secret finding */
export interface SecretFinding {
    /** Unique finding ID */
    id: string;
    /** Pattern that matched */
    patternName: string;
    /** Severity of the finding */
    severity: SecretSeverity;
    /** Category of the pattern */
    category: string;
    /** Matched text (redacted) */
    redactedMatch: string;
    /** Original matched text (NEVER exposed in output) */
    originalLength: number;
    /** Character offset in source text */
    offset: number;
    /** Line number (1-indexed) */
    line: number;
    /** Column number (1-indexed) */
    column: number;
    /** Source file path (if scanning files) */
    sourceFile?: string;
    /** Context snippet around the match */
    context: string;
}
/** Scan statistics */
export interface ScanStats {
    /** Total patterns checked */
    patternsChecked: number;
    /** Total patterns that matched */
    patternsMatched: number;
    /** Total findings */
    totalFindings: number;
    /** Findings by severity */
    bySeverity: Record<SecretSeverity, number>;
    /** Findings by category */
    byCategory: Record<string, number>;
    /** Total characters scanned */
    charsScanned: number;
    /** Total files scanned (if file scan) */
    filesScanned: number;
    /** Files skipped (binary/too large) */
    filesSkipped: number;
    /** Scan duration in ms */
    durationMs: number;
    /** Scan mode used */
    mode: ScanMode;
}
/** Full scan report */
export interface ScanReport {
    /** Report ID */
    id: string;
    /** ISO 8601 timestamp */
    timestamp: string;
    /** Scan mode used */
    mode: ScanMode;
    /** All findings */
    findings: SecretFinding[];
    /** Redacted text (if text scan) */
    redactedText?: string;
    /** Statistics */
    stats: ScanStats;
    /** Whether any CRITICAL or HIGH findings exist */
    hasCriticalFindings: boolean;
    /** Summary line for CLI display */
    summary: string;
}
/** Options for the scanner */
export interface ScannerOptions {
    /** Scan mode (default: DEEP) */
    mode?: ScanMode;
    /** Custom patterns to add */
    customPatterns?: SecretPatternDef[];
    /** Disabled pattern names */
    disabledPatterns?: string[];
    /** Max file size to scan in bytes (default: 1MB) */
    maxFileSize?: number;
    /** File extensions to include (default: text files) */
    includeExtensions?: string[];
    /** File extensions to exclude */
    excludeExtensions?: string[];
    /** Directories to exclude */
    excludeDirs?: string[];
    /** Max context chars around each match (default: 40) */
    contextChars?: number;
    /** Source label for reports */
    sourceLabel?: string;
}
/** Known secret key names for arg-level redaction */
export { SECRET_KEY_NAMES };
export declare class SecretScanner extends EventEmitter {
    private patterns;
    private mode;
    private maxFileSize;
    private includeExtensions;
    private excludeExtensions;
    private excludeDirs;
    private contextChars;
    private sourceLabel;
    private static readonly DEFAULT_TEXT_EXTENSIONS;
    private static readonly DEFAULT_EXCLUDE_DIRS;
    private static readonly BINARY_EXTENSIONS;
    constructor(options?: ScannerOptions);
    /** Scan text for secrets. Returns report with findings and redacted text. */
    scanText(text: string, sourceLabel?: string): ScanReport;
    /** Scan a single file for secrets. */
    scanFile(filePath: string): Promise<ScanReport>;
    /** Scan a directory recursively for secrets. */
    scanDir(dirPath: string): Promise<ScanReport>;
    /** Sanitize tool arguments, redacting known secret key names. */
    sanitizeArgs(args: Record<string, unknown>): Record<string, unknown>;
    /** Get all active patterns for current mode. */
    getActivePatterns(): SecretPatternDef[];
    /** Add a custom pattern at runtime. */
    addPattern(pattern: SecretPatternDef): void;
    /** Remove a pattern by name. */
    removePattern(name: string): boolean;
    /** Enable or disable a pattern. */
    setPatternEnabled(name: string, enabled: boolean): boolean;
    /** List all registered patterns. */
    listPatterns(): SecretPatternDef[];
    /** Format a scan report for terminal display. */
    static formatReport(report: ScanReport): string;
    /** Format a compact summary line. */
    static formatSummary(report: ScanReport): string;
    /** Get severity icon for terminal display. */
    static severityIcon(severity: SecretSeverity): string;
    private findInText;
    private redactText;
    private getLineColumn;
    private getContext;
    private readFileSafe;
    private walkDir;
    private buildStats;
    private buildReport;
    private generateId;
}
/** Quick scan text with default settings. */
export declare function scanText(text: string, mode?: ScanMode): ScanReport;
/** Quick scan a file. */
export declare function scanFile(filePath: string, mode?: ScanMode): Promise<ScanReport>;
/** Quick scan a directory. */
export declare function scanDir(dirPath: string, mode?: ScanMode): Promise<ScanReport>;
/** Redact secrets from text using governance-compatible patterns. */
export declare function redactSecrets(text: string, customPatterns?: RegExp[]): {
    redacted: string;
    count: number;
};
