/**
 * Local redaction and secret-safety guardrails for logs, exports, comments, and debug output.
 */
export declare const SECRET_REDACTION_SCHEMA: string;
export declare const REDACTION_PLACEHOLDER = "[REDACTED]";
export interface SecretPattern {
    name: string;
    pattern: RegExp;
    /** If true, allowlisted contexts skip this pattern */
    allowlist_ok?: boolean;
}
export interface SecretMatch {
    pattern: string;
    match: string;
    index: number;
    line?: number;
}
export interface SecretScanResult {
    schema_version: typeof SECRET_REDACTION_SCHEMA;
    clean: boolean;
    matches: SecretMatch[];
    redacted_text?: string;
}
export interface RedactionOptions {
    custom_patterns?: RegExp[];
    allowlist?: RegExp[];
    placeholder?: string;
}
export declare function registerCustomRedactor(fn: (text: string) => string): void;
export declare function resetCustomRedactors(): void;
export declare function scanTextForSecrets(text: string, options?: RedactionOptions): SecretScanResult;
export declare function redactText(text: string, options?: RedactionOptions): string;
export declare function scanAndRedactText(text: string, options?: RedactionOptions): SecretScanResult;
export declare function scanFileForSecrets(path: string, options?: RedactionOptions): SecretScanResult;
/** Safe JSON stringify for CLI/MCP — redacts object fields and embedded secret patterns in strings. */
export declare function safeStringify(value: unknown, space?: number): string;
export declare function assertNoSecrets(text: string, context?: string): void;
export declare function redactCommentContent(content: string): string;
export declare function redactHandoffPayload(payload: Record<string, unknown>): Record<string, unknown>;
export declare function redactExportRecord(record: Record<string, unknown>): Record<string, unknown>;
export declare function getDefaultSecretPatterns(): Array<{
    name: string;
    source: string;
}>;
//# sourceMappingURL=secret-redaction.d.ts.map