/**
 * Redaction for support output. Templates are pasted into tickets, so anything
 * that reaches them must be scrubbed of secrets AND of local filesystem layout.
 *
 * Three layers, composed by {@link redactText}:
 *   - {@link redactSecrets} (reused from guardrails) — pattern-based token masking.
 *   - {@link scrubHome} — replace the user's home dir with `<home>` so a workspace
 *     path doesn't leak the account/machine layout into a ticket.
 *   - {@link redactArgv} — KEY-AWARE masking of `--token`/`--password`/… values,
 *     which the pattern matcher can't catch (the value is positional). `--ca-pattern`
 *     is deliberately NOT masked: it's a diagnostic the recipient needs.
 */
export interface RedactArgvOptions {
    /** Additional command-specific flags whose values must never be logged. */
    sensitiveFlags?: readonly string[];
}
/** Replace the user's home directory (either separator style, case-insensitively) with `<home>`. */
export declare function scrubHome(text: string, env: NodeJS.ProcessEnv): string;
/** Key-aware argv masking: `--token x` / `--token=x` → `--token [REDACTED]` / `--token=[REDACTED]`. */
export declare function redactArgv(argv: readonly string[], opts?: RedactArgvOptions): string[];
/** Secrets + home scrub for any free text bound for a ticket. */
export declare function redactText(text: string, env: NodeJS.ProcessEnv): string;