/**
 * Redaction for audit-captured arguments.
 *
 * The audit log must never become a secondary store of secrets. Before any
 * call arguments are persisted we:
 *  - drop values under credential-looking keys (token, secret, password, …),
 *  - redact string values that look like bearer tokens / long opaque keys,
 *  - truncate oversized strings and cap the serialized payload size.
 *
 * This mirrors the framework's standing rule that credential-looking literals
 * never land in source, logs, or fixtures.
 */
/** Heuristic: does a bare string value look like a secret? */
declare function looksSecret(value: string): boolean;
declare function redact(value: unknown, depth: number): unknown;
/**
 * Redact and serialize call arguments to a capped JSON string, or `null` when
 * there is nothing to record. Never throws.
 */
export declare function redactArgsToJson(args: unknown): string | null;
/** Exposed for tests. */
export declare const __test: {
    looksSecret: typeof looksSecret;
    redact: typeof redact;
    SENSITIVE_KEY: RegExp;
};
export {};
//# sourceMappingURL=redact.d.ts.map