/**
 * scrubSecrets — shared deterministic secret-redaction pass.
 *
 * Extracted from CiFailurePoller (which still re-exports it for back-compat) so
 * the Correction & Preference Learning Sentinel can apply the SAME regex on both
 * sides of its LLM hop (spec §3.3):
 *   - PRE-SCRUB: applied to captured turns BEFORE they enter the distill prompt
 *     (the egress boundary — scrubbed-but-real context reaches the provider).
 *   - POST-SCRUB: applied to the LLM's learning + scrubbed_summary BEFORE persist
 *     (LLM scrubbing is best-effort recall reduction; this regex is the guarantee).
 *
 * Best-effort, deterministic, no I/O. The regex pass is biased toward catching
 * common token SHAPES; it is the guarantee that obvious secrets never reach the
 * provider or the ledger. It is NOT a substitute for not capturing secrets in
 * the first place — but combined with the metadata-only ledger discipline it is
 * the structural privacy boundary.
 *
 * Coverage (spec §3.3 / round-2 security NEW-3): GitHub PATs (ghp_/gho_/...),
 * generic sk-/pk-/rk- keys, JWTs, key=value secret pairs, Telegram bot tokens,
 * AWS access key IDs, Slack tokens, and URLs with embedded credentials.
 */
export declare function scrubSecrets(text: string): string;
//# sourceMappingURL=scrubSecrets.d.ts.map