/**
 * Redaction for audit-captured arguments.
 *
 * The audit log must never become a secondary store of secrets. Before any
 * call arguments are persisted we:
 *  - drop values under credential-looking keys (token, secret, password, …),
 *  - redact string values that look like bearer tokens / long opaque keys,
 *  - truncate oversized strings and cap the serialized payload size.
 *
 * This mirrors the framework's standing rule that credential-looking literals
 * never land in source, logs, or fixtures.
 */
declare function looksSecret(value: string): boolean;
declare function redactEmbeddedSecrets(value: string): string;
declare function redact(value: unknown, depth: number, limits: Required<Pick<RedactLimits, "maxString" | "maxDepth" | "maxKeys" | "maxArray" | "overflow">> & Pick<RedactLimits, "redactEmbeddedSecrets" | "redactGenericOpaqueStrings">): unknown;
export interface RedactLimits {
    maxJson?: number;
    maxString?: number;
    maxDepth?: number;
    maxKeys?: number;
    maxArray?: number;
    overflow?: "truncate" | "throw";
    redactEmbeddedSecrets?: boolean;
    redactGenericOpaqueStrings?: boolean;
}
export declare function redactArgsToJson(args: unknown, limits?: RedactLimits): string | null;
/**
 * Whether `value`, parsed from `redactArgsToJson`, lost part of the
 * arguments to its limits: a shortened string or array, dropped keys, depth,
 * or the whole payload replaced by its `_auditTruncated` preview. A redacted
 * secret is not a cut. Text that only looks like a marker reads as cut,
 * which errs toward telling a reader something is missing.
 */
export declare function redactedArgsWereCut(value: unknown): boolean;
export declare function redactArgsToValue(args: unknown, limits?: RedactLimits): unknown;
export declare function redactTextToSummary(text: string, maxChars?: number): string | null;
export declare const __test: {
    looksSecret: typeof looksSecret;
    redact: typeof redact;
    redactEmbeddedSecrets: typeof redactEmbeddedSecrets;
    SENSITIVE_KEY: RegExp;
};
export {};