/**
 * Security Scanner — PII pattern scanning + entropy / placeholder filtering
 * @module @skillsmith/core/security/scanner/SecurityScanner.pii
 *
 * SMI-5434: Section 3 of SecurityScanner.scanners.ts extracted to keep the
 * parent file under the 500-line audit:standards gate. Pure functions of
 * (content, lineContexts) — no scanner instance state.
 */
import type { SecurityFinding } from './types.js';
import type { LineContext } from './SecurityScanner.helpers.js';
/**
 * SMI-5420: named-placeholder markers that indicate an example, not a real
 * secret. Intentionally NO `X{4,}` rule — it would test the raw match string and
 * short-circuit before the entropy check, downgrading a REAL high-entropy secret
 * that coincidentally contains `xxxx` (governance FN). An all-repeated-char value
 * (e.g. `xxxx…`) is caught by the `/^(.)\1+$/` check in looksLikePlaceholderSecret
 * instead, and partial-repeat low-variety values by the entropy floor.
 *
 * SMI-5423: the SHORT markers (FAKE/DUMMY/SAMPLE/YOUR, ≤6 chars) are guarded with
 * a negative lookbehind `(?<![A-Za-z0-9])` so they only match as a delimited token
 * (`FAKE_KEY`, `<FAKE>`, value-start) — NOT mid-random-string (`k7FAKE1abc`), which
 * is the same raw-match short-circuit FN class as the removed `X{4,}`. Longer
 * markers (EXAMPLE/PLACEHOLDER/CHANGEME/REDACTED, 7+ chars) stay unbounded: their
 * coincidence probability is negligible AND `AKIA…7EXAMPLE` needs EXAMPLE to match
 * mid-token.
 *
 * Accepted tradeoff (SMI-5423 governance): a digit-immediately-prefixed token like
 * `1FAKE_KEY` fails the lookbehind and scores critical rather than low. This is the
 * FP-SAFE direction (over-flag a rare contrived placeholder) — strictly preferable
 * in a security scanner to the FN it replaces (a real secret downgraded); and a
 * longer such value falls under the entropy floor anyway.
 *
 * SMI-5207: exported (additively — `looksLikePlaceholderSecret` below is
 * unchanged, and MF-1 / scanPiiPatterns keep sharing it byte-identically) so
 * MF-4's isProseValue() can reuse the same placeholder vocabulary when
 * deciding whether an assigned credential value references a secret rather
 * than containing one. No `g` flag, so `.test()` is stateless and safe to
 * share across call sites.
 */
export declare const PLACEHOLDER_SECRET_RE: RegExp;
/** SMI-5420: Shannon entropy (bits per character) of a string. */
export declare function shannonEntropy(s: string): number;
/**
 * SMI-5420: a credential match is a documentation placeholder (not a real leaked
 * secret) when it carries a named placeholder marker, is a single repeated
 * character, or its value has sub-secret Shannon entropy. Such matches must NOT
 * emit critical/high severity — the batch trust-scorer (trust-scorer.ts) and the
 * install gate quarantine on severity, so an example secret would falsely flag.
 */
export declare function looksLikePlaceholderSecret(match: string): boolean;
/** SMI-3864: Detect PII patterns. Email in YAML frontmatter gets low severity. */
export declare function scanPiiPatterns(content: string, lineContexts?: LineContext[]): SecurityFinding[];
//# sourceMappingURL=SecurityScanner.pii.d.ts.map