//#region src/hardening/weak-secret.d.ts
/**
 * Weak-secret heuristics. Pure, side-effect-free, and dependency-free
 * so the pepper / passphrase / token paths can fail fast on values that
 * pass a raw length check yet are obviously low quality (e.g. the
 * `"test-pepper-32-bytes-aaaaaaaaaaaa"` placeholder seen in examples
 * and CI smoke runs - 32 bytes, but a 12-byte run of identical
 * characters and low Shannon entropy).
 *
 * The thresholds are deliberately conservative: a `crypto.randomBytes`
 * value of the required length never trips them (32 random bytes have
 * ~4.5-5 observed bits/byte and a near-zero chance of an 8-byte
 * identical run), so legitimate secrets are unaffected.
 *
 * @packageDocumentation
 */
/** Tunable thresholds for {@link assessSecretStrength}. */
interface SecretStrengthOptions {
  /** Minimum byte length. Default `32`. */
  readonly minBytes?: number;
  /** Minimum Shannon entropy in bits per byte. Default `3`. */
  readonly minShannonBitsPerByte?: number;
  /**
   * Reject when this many identical bytes appear consecutively.
   * Default `8`.
   */
  readonly maxIdenticalRun?: number;
}
/** Result of {@link assessSecretStrength}. */
interface SecretStrength {
  /** Whether the secret cleared every threshold. */
  readonly ok: boolean;
  readonly byteLength: number;
  /** Estimated Shannon entropy of the byte distribution (bits/byte). */
  readonly shannonBitsPerByte: number;
  /** Longest run of identical consecutive bytes. */
  readonly maxIdenticalRun: number;
  /** Number of distinct byte values. */
  readonly distinctBytes: number;
  /** Human-readable reason when `ok` is `false`. */
  readonly reason?: string;
}
/**
 * Assess the strength of a raw secret buffer. Pure: callers decide
 * whether to throw or WARN on `ok === false`.
 *
 * @stable
 */
declare function assessSecretStrength(bytes: Uint8Array, options?: SecretStrengthOptions): SecretStrength;
//#endregion
export { SecretStrength, SecretStrengthOptions, assessSecretStrength };
//# sourceMappingURL=weak-secret.d.ts.map