/** * Statistical analysis for detecting obfuscated or suspicious text segments. * Zero dependencies, pure TypeScript. */ import type { Severity } from "./types.js"; export type EntropyFinding = { type: string; message: string; severity: Severity; evidence: string; offset: number; }; export type EntropyResult = { shannonEntropy: number; charFrequency: Map; suspiciousPatterns: EntropyFinding[]; }; /** * Calculate Shannon entropy (bits per character) for the full input string. */ export declare function shannonEntropy(input: string): number; /** * Build a character frequency map for the input. */ export declare function charFrequency(input: string): Map; /** * Detect high-entropy segments using a sliding window. * Window size: 64 chars. * Threshold: 4.5 bits for Latin/ASCII text, 6.5 bits for wide-charset scripts * (Korean Hangul, CJK, Japanese) which naturally have high entropy due to * their large alphabets (e.g., 11,172 Hangul syllable blocks). */ export declare function detectHighEntropySegments(input: string): EntropyFinding[]; /** * Detect low-entropy repetition: same character repeated 20+ times, * or same short pattern repeated 20+ times. */ export declare function detectLowEntropyRepetition(input: string): EntropyFinding[]; /** * Detect unusual Unicode block mixing within the same sentence. * Flags when Latin, Cyrillic, and CJK characters appear together. */ export declare function detectUnicodeMixing(input: string): EntropyFinding[]; /** * Detect high density of invisible/control/zero-width characters. * Flags if >5% of characters are invisible. */ export declare function detectInvisibleCharDensity(input: string): EntropyFinding[]; /** * Detect encoding fingerprints suggesting embedded encoded payloads. * High ratio of +/= suggests base64; high ratio of % suggests URL encoding. */ export declare function detectEncodingFingerprints(input: string): EntropyFinding[]; /** * Run full entropy analysis on input text. */ export declare function analyzeEntropy(input: string): EntropyResult;