/**
 * Secrets Scanner for NotebookLM MCP Server
 *
 * Detects and prevents credential exposure:
 * - API keys
 * - Passwords
 * - Tokens
 * - Private keys
 * - Connection strings
 *
 * Why this matters:
 * - Prevents accidental credential logging
 * - Detects leaked secrets in responses
 * - Compliance with security best practices
 *
 * Patterns derived from: TruffleHog, GitLeaks, MEDUSA
 * Added by Pantheon Security for hardened fork.
 */
/**
 * Secret detection result
 */
export interface SecretMatch {
    type: string;
    pattern: string;
    match: string;
    redacted: string;
    /** Byte offset in the original scanned string — used for correct right-to-left redaction */
    index: number;
    line?: number;
    column?: number;
    severity: "critical" | "high" | "medium" | "low";
}
/**
 * Secret pattern definition
 */
interface SecretPattern {
    name: string;
    pattern: RegExp;
    severity: "critical" | "high" | "medium" | "low";
    description: string;
    redactFn?: (match: string) => string;
    /** Only flag matches whose Shannon entropy exceeds this threshold */
    minEntropy?: number;
    /** Skip known benign high-entropy fields for generic detectors */
    ignoreContext?: (input: string, match: RegExpExecArray) => boolean;
}
/**
 * Calculate Shannon entropy of a string (bits per character).
 * Exported so response-validator can reuse it.
 */
export declare function shannonEntropy(s: string): number;
/**
 * Secrets Scanner Configuration
 */
export interface SecretsConfig {
    /** Enable secrets scanning (default: true) */
    enabled: boolean;
    /** Block output containing secrets (default: false - just warn) */
    blockOnDetection: boolean;
    /** Auto-redact secrets in output (default: true) */
    autoRedact: boolean;
    /** Minimum severity to report (default: low) */
    minSeverity: "critical" | "high" | "medium" | "low";
    /** Custom patterns to add */
    customPatterns: SecretPattern[];
    /** Patterns to ignore (by name) */
    ignoredPatterns: string[];
}
/**
 * Secrets Scanner Class
 */
export declare class SecretsScanner {
    private config;
    private patterns;
    private stats;
    constructor(config?: Partial<SecretsConfig>);
    /**
     * Scan text for secrets
     */
    scan(text: string): SecretMatch[];
    /**
     * Scan and optionally redact secrets
     */
    scanAndRedact(text: string): Promise<{
        clean: string;
        secrets: SecretMatch[];
        blocked: boolean;
    }>;
    /**
     * Default redaction function
     */
    private defaultRedact;
    /**
     * Add a custom pattern
     */
    addPattern(pattern: SecretPattern): void;
    /**
     * Ignore a pattern by name
     */
    ignorePattern(name: string): void;
    /**
     * Get scanning statistics
     */
    getStats(): typeof this.stats & {
        patterns: number;
    };
    /**
     * Reset statistics
     */
    resetStats(): void;
    /**
     * Update configuration
     */
    updateConfig(config: Partial<SecretsConfig>): void;
    /**
     * Check if scanning is enabled
     */
    isEnabled(): boolean;
}
/**
 * Get or create the global secrets scanner
 */
export declare function getSecretsScanner(): SecretsScanner;
/**
 * Convenience function to scan text for secrets
 */
export declare function scanForSecrets(text: string): SecretMatch[];
/**
 * Convenience function to scan and redact secrets
 */
export declare function scanAndRedactSecrets(text: string): Promise<{
    clean: string;
    secrets: SecretMatch[];
    blocked: boolean;
}>;
export {};