/**
 * liveTailRedaction — versioned secret-redaction for the live tail (spec §8 G3c).
 *
 * The live tail carries the most sensitive data in the system (user messages,
 * tool outputs, incidentally-present secrets). Before any tail content leaves
 * this machine it is scrubbed of credential-shaped material. The category set
 * is a NAMED, VERSIONED enum (not an ad-hoc inline regex) so it can be extended
 * as new token/credential shapes appear — combined with carry-by-reference for
 * large tool output (§8 G3b), the tail minimizes raw sensitive bytes
 * structurally rather than relying on pattern-matching alone.
 *
 * Bump REDACTION_CATEGORY_VERSION when the category set changes, so a receiver
 * can record which version scrubbed a flush.
 */
export declare const REDACTION_CATEGORY_VERSION = 1;
export declare enum RedactionCategory {
    BearerToken = "bearer-token",
    ApiKey = "api-key",
    PrivateKeyBlock = "private-key-block",
    AwsAccessKey = "aws-access-key",
    SecretAssignment = "secret-assignment",
    JwtLike = "jwt-like"
}
export interface RedactionResult {
    text: string;
    redactedCount: number;
    categories: RedactionCategory[];
    version: number;
}
/**
 * Redact credential-shaped material from a string. Returns the scrubbed text,
 * how many redactions occurred, and which categories fired (for the flush's
 * redaction metadata).
 */
export declare function redactForLiveTail(input: string): RedactionResult;
//# sourceMappingURL=liveTailRedaction.d.ts.map