/**
 * Credential Redaction Utilities for External Issue Spawn
 *
 * Ensures that API tokens, credentials, and other secrets are never
 * leaked into logs, CLI output, stored metadata, or error messages.
 */
/**
 * Redact known credential patterns from a string.
 *
 * Replaces matching substrings with `[REDACTED]`.
 *
 * @param input - String that may contain credentials
 * @returns Sanitized string with credentials replaced
 */
export declare function redactCredentials(input: string): string;
/**
 * Check whether a string contains any known credential patterns.
 *
 * @param input - String to scan
 * @returns Array of detected credential labels (empty if clean)
 */
export declare function detectCredentials(input: string): string[];
/**
 * Check whether a string contains any live secret values from the current environment.
 *
 * Looks up each SECRET_ENV_VAR in process.env and tests whether
 * the input contains that value literally.
 *
 * @param input - String to scan
 * @returns Array of env var names whose values appear in the input (empty if clean)
 */
export declare function detectEnvSecrets(input: string): string[];
/**
 * Scan a metadata record for credential leaks.
 *
 * Checks both keys and values for patterns that look like secrets.
 *
 * @param metadata - Key-value record to scan
 * @returns Array of issues found (empty if clean)
 */
export declare function auditMetadata(metadata: Record<string, string>): string[];
/**
 * Assert that a string is free of credentials.
 * Throws if any credentials are detected.
 *
 * @param input - String to check
 * @param context - Description of what is being checked (for error message)
 * @throws Error if credentials are found
 */
export declare function assertNoCredentials(input: string, context: string): void;
