/**
 * Secrets Scanner
 *
 * Detects hardcoded secrets, API keys, and credentials using:
 * 1. gitleaks CLI if available — scans BOTH git commit history AND the
 *    working tree so secrets that were committed and later removed are caught.
 * 2. Fallback to regex-based detection (degraded mode; signals degraded=true).
 *
 * All secrets findings are severity: critical.
 * This scanner is recall-biased: a missed credential is a breach; a false
 * alarm costs 2 seconds.  Do NOT tighten filters here without a strong reason.
 *
 * @module scanners/secrets
 */
import type { DeterministicFinding, ScannerResult } from "./types.js";
/**
 * Precision filter for raw gitleaks results.  gitleaks is high-recall but
 * noisy (it flagged ~4x what Snyk Code did on a real app): the same secret
 * repeated across files, low-entropy non-secrets, and test/example/fixture
 * keys all land as `critical`/confidence 100.  This trims noise conservatively
 * — it only drops matches that are very unlikely to be a real production secret
 * so a genuine leak is never lost.
 *
 * NOTE: The secrets scanner calls this with skipNonProductionPaths:false and
 * minEntropy:2.0 (recall-biased).  Other scanners that call this function keep
 * the precision-biased defaults.  Do NOT change the defaults here.
 */
export declare function filterGitleaksResults(results: GitleaksOutput[], projectPath: string, options?: {
    /** Drop entropy-based matches below this (0 = rule had no entropy, kept). */
    minEntropy?: number;
    /** Collapse the same secret value to one finding. */
    dedupeBySecret?: boolean;
    /** Skip test/fixture/example/mock/vendor paths. */
    skipNonProductionPaths?: boolean;
}): {
    kept: GitleaksOutput[];
    dropped: {
        entropy: number;
        duplicate: number;
        path: number;
    };
};
/**
 * gitleaks JSON output structure
 */
interface GitleaksOutput {
    Description: string;
    StartLine: number;
    EndLine: number;
    StartColumn: number;
    EndColumn: number;
    Match: string;
    Secret: string;
    File: string;
    SymlinkFile: string;
    Commit: string;
    Entropy: number;
    Author: string;
    Email: string;
    Date: string;
    Message: string;
    Tags: string[];
    RuleID: string;
    Fingerprint: string;
}
/**
 * Run secrets detection and return findings.
 *
 * When gitleaks is available, scans BOTH git commit history (to catch secrets
 * that were committed and later removed) AND the working tree (uncommitted
 * files).  Findings are merged and deduped.
 *
 * When gitleaks is unavailable, falls back to regex-based detection and marks
 * the result degraded=true so callers can surface an explicit warning.
 */
export declare function runSecretsScanner(projectPath: string, opts?: {
    historyTimeoutMs?: number;
    workingTreeTimeoutMs?: number;
}): Promise<ScannerResult>;
/**
 * Map a GitleaksOutput record to our DeterministicFinding type.
 * Redacts the raw secret value in the evidence field.
 */
/** @internal Exported for unit testing the absolute→repo-relative path rebasing. */
export declare function toFinding(result: GitleaksOutput, projectPath: string): DeterministicFinding;
export declare function checkGitleaksAvailable(): Promise<{
    available: boolean;
    version?: string;
    error?: string;
}>;
/**
 * Reset the memoized availability cache.  Used in tests only.
 * @internal
 */
export declare function _resetGitleaksAvailabilityCache(): void;
/**
 * Override the memoized availability cache with a fixed result.
 * Call _resetGitleaksAvailabilityCache() after the test to restore normal
 * probe behaviour.  Used in tests only.
 * @internal
 */
export declare function _setGitleaksAvailabilityForTest(result: {
    available: boolean;
    version?: string;
    error?: string;
}): void;
export {};
//# sourceMappingURL=secrets.d.ts.map