/**
 * Zero-dependency secret scanner.
 *
 * Two surfaces:
 *   1. Working tree — walks the project and scans every text file (including
 *      dotfiles like .env / .npmrc, which generic code walkers skip but which
 *      are the single most common place real secrets leak).
 *   2. Git history — parses `git log -p` so a secret that was committed and
 *      later removed is still surfaced; it remains exposed in history even
 *      though the working tree no longer shows it. This is the high-value case
 *      for a credential-leak audit.
 *
 * Detection = high-precision vendor/assignment regexes (always on) plus an
 * optional Shannon-entropy heuristic for unrecognized high-randomness strings.
 * Every reported secret is redacted — the raw value is never stored or printed.
 */
import type { SecretScanOptions, SecretScanResult } from "./types.js";
export declare function redactSecret(secret: string): string;
/**
 * Mask every recognized credential in a blob of text, in place. Used by the
 * agent firewall to defang tool output before the model reads it, so a secret
 * surfaced in a fetched page / log / API response is never ingested or echoed.
 * Returns the redacted text and the count of secrets masked.
 */
export declare function redactSecretsInText(text: string): {
    text: string;
    count: number;
};
export declare function scanForSecrets(root: string, options?: SecretScanOptions): Promise<SecretScanResult>;