/**
 * Phase 11 — centralized log redactor.
 *
 * Single `sanitize(text)` function applied at every log choke point:
 *   - Fastify logger transform
 *   - patched console.* (production only)
 *   - API error response middleware
 *   - pushSeed() git output capture
 *
 * Redaction rules, in order:
 *   1. Registry-driven substring match: every env-var value listed under
 *      a non-`redact: 'never'` registry entry is looked up at call time
 *      and substring-replaced with `[REDACTED:<key.name>]`. The lookup
 *      is dynamic so rotated values track without a process restart.
 *   2. Prefix-matched tokens — `sk-*`, `ghp_*`, `ghu_*`, `ghs_*`,
 *      `xox[bp]-*`, `AKIA*`, `glpat-*`, `Bearer *`, `Basic *`.
 *   3. URL with embedded credentials — `https?://user:pass@…`.
 *   4. JSON-quoted secret-named fields — `"Authorization": "<value>"`,
 *      `"api_key": "…"`, etc.
 *
 * Each replacement uses `[REDACTED:<name>]` when there's a registry hit,
 * `[REDACTED]` otherwise. Replacements are idempotent — running
 * `sanitize()` twice on the same string produces the same output.
 *
 * Performance: every log line walks the registry once. Registry is ~30
 * entries today; tested at ~50µs per call on a typical Node host. The
 * patched-console path means every console.warn in production pays this
 * cost — acceptable given the alternative is shipping secrets to stdout.
 *
 * Escape hatch: callers can pre-check `process.env.STUDIOGRAPH_LOG_RAW === '1'`
 * before invoking sanitize() if they need raw output for local debugging.
 * The patched-console wrapper in serve.ts honours this flag.
 */
/**
 * Sanitize a single string. Idempotent — `sanitize(sanitize(s)) === sanitize(s)`.
 *
 * Returns the input untouched when it's not a string. Non-string inputs
 * are passed through so callers can use it as a generic transform.
 */
export declare function sanitize(text: unknown): string;
/**
 * Convenience: sanitize multi-arg console-style invocations. Each arg
 * is sanitized independently and returned as a string array — caller
 * decides how to join.
 */
export declare function sanitizeArgs(args: unknown[]): string[];
