/**
 * Redaction — remove PII / secrets from trace payloads before persist.
 *
 * Pre-persistence rules mean raw traces in storage are already scrubbed.
 * Unredacted variants (for debugging / post-mortems) live in a separate
 * storage layer with stricter access controls; this module only covers
 * the default scrub-then-persist path.
 *
 * Rules compose: pass an array of `RedactionRule`, each is applied in
 * order. Strings that match get replaced with a tagged sentinel so the
 * eval framework can count how many redactions happened per run
 * (surfaced via `redaction_applied` events).
 */
export interface RedactionRule {
    id: string;
    pattern: RegExp;
    /** Replacement — e.g. '[PII:email]'. Defaults to `[redacted:{id}]`. */
    replacement?: string;
}
export interface RedactionReport {
    redactionCount: number;
    byRule: Record<string, number>;
}
/** OWASP / common-sense defaults — extend per-domain. */
export declare const DEFAULT_REDACTION_RULES: RedactionRule[];
export declare const REDACTION_VERSION = "1.0.0";
/**
 * Redact a single string. Returns the new string and a per-rule count of
 * how many substitutions fired.
 */
export declare function redactString(input: string, rules?: RedactionRule[]): {
    output: string;
    report: RedactionReport;
};
/**
 * Walk a JSON-ish value applying `redactString` to every string leaf.
 * Arrays and plain objects are recursed; other types pass through
 * untouched. Circular references throw — traces should be tree-shaped.
 */
export declare function redactValue(value: unknown, rules?: RedactionRule[], report?: RedactionReport): {
    value: unknown;
    report: RedactionReport;
};
//# sourceMappingURL=redact.d.ts.map