/**
 * Secret detection rules. Ordered most-specific first so a precise vendor match
 * (e.g. "GitHub PAT") wins over a generic assignment match on the same line.
 *
 * Each rule's `re` is global so the scanner can find every occurrence on a line.
 * `group` is the capture group holding the secret value (default 0 = whole match)
 * — used both for redaction and for placeholder filtering. Every quantifier is
 * upper-bounded to a realistic token length so a pathological multi-kB line
 * cannot make a rule swallow the whole line (false positives + backtracking).
 *
 * Rules flagged `generic` match on a key NAME (api_key/secret/...) rather than a
 * self-identifying value prefix, so the scanner applies an extra value-shape
 * guard to them to suppress paths / URLs / version strings.
 *
 * The vendor and generic patterns mirror src/review/analyzer.ts so the two
 * detectors stay consistent, extended here to the tokens most worth catching.
 */
import type { SecretSeverity } from "./types.js";
export type SecretRule = {
    id: string;
    label: string;
    severity: SecretSeverity;
    re: RegExp;
    /** Capture group holding the secret (default: whole match). */
    group?: number;
    /** Matches on a key name, not a value prefix — apply the value-shape guard. */
    generic?: boolean;
};
export declare const SECRET_RULES: SecretRule[];