/**
 * Log redactor — mask secrets before a raw daemon log line leaves the machine.
 *
 * Daemon logs can incidentally contain credentials: ADHDev API keys (adk_*),
 * machine secrets (adm_*), provider keys (adp_*), bearer tokens, JWTs, TURN
 * `username:credential` pairs, and `SECRET=...` style env dumps. The mesh
 * `get_mesh_node_logs` command ships a log tail over P2P to the coordinator, so
 * every line MUST pass through redactLogLine() first — otherwise a secret in a
 * remote daemon's log is exfiltrated to whoever is driving the coordinator.
 *
 * Patterns are intentionally conservative: each masks the secret material while
 * preserving enough surrounding shape that the line stays useful for debugging
 * (e.g. `adk_••••1234`, `Bearer ••••redacted`). When in doubt, mask.
 */
/**
 * Mask secrets in a single log line. Idempotent-ish: re-running over an
 * already-masked line leaves the MASK token in place (it contains no secret
 * shape). Never throws — a redaction failure must not crash the log path.
 */
export declare function redactLogLine(line: string): string;
/** Redact an array of log lines in place-safe fashion (returns a new array). */
export declare function redactLogLines(lines: string[]): string[];
/** Exposed for tests/introspection: the rule names applied, in order. */
export declare const LOG_REDACTION_RULE_NAMES: readonly string[];
