/**
 * Shannon entropy calculation.
 *
 * Measures the randomness of a string. Higher entropy = more random = more
 * likely to be a real secret. Gitleaks uses entropy thresholds on many rules
 * to reduce false positives.
 *
 * Formula: H = -Σ p(x) * log2(p(x)) for each unique character x
 */
declare function shannonEntropy(s: string): number;

interface AllowlistRegex {
    regex: RegExp;
    target?: 'match' | 'line';
}
interface RuleAllowlist {
    regexes?: AllowlistRegex[];
    stopwords?: string[];
}
interface Rule {
    id: string;
    label: string;
    regex: RegExp;
    keywords: string[];
    entropy?: number;
    secretGroup?: number;
    allowlist?: RuleAllowlist;
}

/**
 * @sanity-labs/secret-scan
 *
 * Detect and redact secrets in strings. Works in browser and Node.js.
 * Zero runtime dependencies. Rules derived from TruffleHog detectors (Apache 2.0).
 */
interface Secret {
    /** Rule ID, e.g. 'openai' */
    rule: string;
    /** Human-readable label, e.g. 'Openai' */
    label: string;
    /** The matched secret value */
    text: string;
    /** Match confidence: 'high' for provider-specific patterns, 'medium' for generic/entropy-based */
    confidence: 'high' | 'medium';
    /** Start index of the secret in the input string */
    start: number;
    /** End index (exclusive) of the secret in the input string */
    end: number;
}
/**
 * Scan a string for secrets.
 *
 * Two-phase approach:
 * 1. Collect ALL candidate matches from all rules (no overlap filtering yet)
 * 2. Resolve overlaps by preferring the longest match
 *
 * This prevents a short match from an earlier rule blocking a longer,
 * more correct match from a later rule. For example, TruffleHog's postgres
 * rule captures just "postgres" from a full connection string URL — the
 * custom database-connection-string rule captures the full URL and should win.
 *
 * Uses keyword pre-filtering for performance — most of the 1,100+ regexes
 * are skipped for any given input.
 */
declare function scan(input: string): Secret[];
/**
 * Find and replace secrets in a string.
 *
 * Calls `replacer` for each detected secret. The return value replaces
 * the secret in the output string. The caller owns all state — `redact`
 * just does string replacement.
 *
 * Replacements are applied from right to left to preserve string indices.
 */
declare function redact(input: string, replacer: (secret: Secret) => string): string;

export { type Rule, type Secret, redact, scan, shannonEntropy };