import type { Liveness, ProbeFetch } from "./verdict.js";
export type { Liveness, ProbeFetch } from "./verdict.js";
export declare const defaultProbeFetch: ProbeFetch;
type SecretClass = {
    kind: "signing-secret";
} | {
    kind: "stripe-key";
} | {
    kind: "github-token";
} | {
    kind: "unknown";
};
/** Classify a leaked credential by its prefix (the secret-class model). */
export declare function classifySecret(rawValue: string): SecretClass;
export interface ProbeDeps {
    fetch?: ProbeFetch;
}
/**
 * Probe a leaked credential's liveness. A signing-secret / unknown-class value
 * returns `unverified` WITHOUT any provider call; only an api-key-class value
 * reaches a probe. `rawValue` is in-memory only and never logged.
 */
export declare function probeLiveness(rawValue: string, deps?: ProbeDeps): Promise<Liveness>;
/**
 * Recover the RAW leaked credential from the source region a LEAK finding points
 * at. The finding's `location` spans the HANDLER (not the literal), and the
 * snippet is redacted — so to probe, the CLI re-reads the user's own source and
 * scans the handler region for one of the provider's catalog prefixes, returning
 * the full `prefix + value` run. Returns null when no prefix is found. The value
 * is the caller's to hold in-memory only (D-04).
 */
export declare function extractCredential(sourceText: string, region: {
    line: number;
    endLine: number;
}, prefixes: ReadonlyArray<string>): string | null;
/**
 * Strip any provider key fragment from a string before it can reach output.
 * Mirrors the private rotation adapter's `sanitiseProbeError` (V7 / D-04).
 */
export declare function sanitiseProbeError(err: unknown): string;
//# sourceMappingURL=index.d.ts.map