/**
 * Redaction pipeline — strips sensitive data from traces before storage.
 *
 * Applied before ANY storage (both blob and Content Lake). Configurable
 * patterns handle Bearer tokens, API keys, Sanity tokens, and other
 * common secret formats.
 *
 * Principles:
 * 1. Redact before store — sensitive data never reaches storage
 * 2. Configurable patterns — teams can add project-specific rules
 * 3. Truncation for cost — large outputs truncated to max bytes
 * 4. No PII by default — tasks shouldn't contain PII, this is a safety net
 *
 * @see docs/design-docs/architecture-overhaul/observability-telemetry.md
 */
import type { EvalTrace } from "../../../_vendor/ailf-core/index.d.ts";
/** A single redaction rule */
export interface RedactionRule {
    /** Rule name (for logging) */
    name: string;
    /** Regex pattern to match */
    pattern: RegExp;
    /** Replacement string (use $1, $2 for capture groups) */
    replacement: string;
}
/** Redaction configuration */
export interface RedactionConfig {
    /** Regex-based substitution rules */
    rules: RedactionRule[];
    /** Fields to omit entirely from stored traces */
    omitFields: string[];
    /** Maximum tool call output size in bytes */
    maxOutputBytes: number;
}
/** Result of redaction */
export interface RedactionResult {
    /** Redacted trace */
    trace: EvalTrace;
    /** Number of redactions applied */
    redactionCount: number;
    /** Which rules fired */
    rulesApplied: string[];
}
/** Built-in redaction rules for common secret patterns */
export declare const DEFAULT_REDACTION_RULES: RedactionRule[];
/**
 * Create a default redaction config.
 *
 * @param overrides - Custom rules or settings to merge
 */
export declare function createRedactionConfig(overrides?: Partial<RedactionConfig>): RedactionConfig;
/**
 * Apply redaction to an evaluation trace.
 *
 * Processes tool call inputs and outputs, event data, and search terms.
 * Returns a new trace (does not mutate the original).
 */
export declare function redactTrace(trace: EvalTrace, config?: RedactionConfig): RedactionResult;
