/**
 * Output Filter Service — API Key Redaction
 *
 * Scans all agent text output for API key patterns and replaces them
 * with [REDACTED] before the output reaches users or logs.
 *
 * Detects patterns from major providers (OpenAI, Anthropic, Google, AWS)
 * as well as generic key/token/secret assignments.
 *
 * @module services/agent/crewly-agent/output-filter.service
 *
 * @example
 * ```typescript
 * const filter = new OutputFilterService();
 * const safe = filter.redact('My key is sk-abc123xyz');
 * // => 'My key is [REDACTED]'
 * ```
 */
/**
 * A single API key detection pattern with a label for audit logging.
 */
export interface KeyPattern {
    /** Regex to match the key in text */
    pattern: RegExp;
    /** Human-readable label for audit/logging */
    label: string;
}
/**
 * Result of scanning text for API keys.
 */
export interface ScanResult {
    /** Whether any keys were detected */
    detected: boolean;
    /** Number of keys found */
    count: number;
    /** Labels of the matched patterns */
    matchedPatterns: string[];
    /** Redacted text with keys replaced */
    redactedText: string;
}
/**
 * API key patterns for major providers and generic secrets.
 *
 * Each pattern uses word boundaries or lookbehind/lookahead to minimize
 * false positives while catching real key formats.
 */
export declare const API_KEY_PATTERNS: readonly KeyPattern[];
/** Replacement text for redacted keys */
export declare const REDACTION_PLACEHOLDER = "[REDACTED]";
/**
 * Service that scans and redacts API keys from agent output text.
 */
export declare class OutputFilterService {
    private readonly patterns;
    /**
     * Creates a new OutputFilterService.
     * @param customPatterns - Optional additional patterns to detect (appended to defaults)
     */
    constructor(customPatterns?: KeyPattern[]);
    /**
     * Scans text for API keys and returns detailed results.
     *
     * @param text - Text to scan for API keys
     * @returns Scan result with detection info and redacted text
     */
    scan(text: string): ScanResult;
    /**
     * Redacts all API keys in the given text.
     * Convenience method that returns only the redacted string.
     *
     * @param text - Text to redact
     * @returns Text with all detected API keys replaced with [REDACTED]
     */
    redact(text: string): string;
    /**
     * Checks if text contains any API keys without modifying it.
     *
     * @param text - Text to check
     * @returns True if any API key patterns are detected
     */
    containsKeys(text: string): boolean;
    /**
     * Redacts API keys from a structured object (recursively scans string values).
     * Useful for sanitizing tool call arguments and results before logging.
     *
     * @param obj - Object to scan and redact
     * @returns Deep copy with all string values redacted
     */
    redactObject(obj: unknown): unknown;
}
//# sourceMappingURL=output-filter.service.d.ts.map