/**
 * Credential Leak Detection — Entropy Analysis
 *
 * Shannon entropy calculation for detecting high-entropy strings
 * that look like secrets (random tokens, keys, passwords).
 */
/**
 * Calculate Shannon entropy of a string (bits per character).
 * Higher entropy = more random/unpredictable.
 *
 * Reference values:
 * - English text: ~3.5-4.0
 * - Base64 encoded: ~5.0-5.5
 * - Random hex: ~3.5-4.0
 * - Random alphanumeric: ~5.5-5.9
 * - Crypto keys: ~5.5-6.0+
 */
export declare function shannonEntropy(str: string): number;
/** Minimum string length for entropy-based detection */
export declare const MIN_ENTROPY_LENGTH = 20;
/** Entropy threshold — strings above this are flagged */
export declare const ENTROPY_THRESHOLD = 4.5;
/**
 * Check if a string looks like a high-entropy secret.
 * Returns confidence score (0-1) or null if not suspicious.
 */
export declare function checkHighEntropy(str: string): {
    entropy: number;
    confidence: number;
} | null;
/**
 * Extract candidate high-entropy tokens from content.
 * Looks for long contiguous alphanumeric+special strings
 * that could be secrets.
 */
export declare function extractHighEntropyTokens(content: string): Array<{
    token: string;
    position: number;
    entropy: number;
    confidence: number;
}>;
/**
 * Allowlist of well-known PUBLIC identifier shapes that are NOT secrets and
 * must never be flagged as credentials — by ANY detector (pattern OR entropy).
 *
 * Conservative on purpose: only the exact canonical shapes below are excluded,
 * so real secrets (sk_live_..., random base64 tokens) still trip detection.
 * The token is matched on its own boundaries (anchored), so a SHA-shaped
 * substring of a longer secret is NOT what gets matched here — callers pass the
 * isolated token.
 */
export declare function isWellKnownNonSecret(token: string): boolean;
