/**
 * Credential names that always redact, regardless of nesting, case, or
 * snake/hyphen separators. `connectionString` commonly embeds URL credentials.
 * Ambiguous public metadata names such as `seed` and `token` are not included.
 */
export declare const DEFAULT_REDACTED_KEY_NAMES: readonly string[];
/**
 * Suffix-matched key names that redact. Catches any future `*PrivateKey`,
 * `*Secret`, or `*Password` field without enumerating them.
 */
export declare const DEFAULT_REDACTED_KEY_SUFFIX: RegExp;
export interface RedactConfigOptions {
    /** Extra key names; case and snake/hyphen separators are ignored. */
    readonly keyNames?: readonly string[];
    /** Replaces the default suffix pattern; tests original keys without global/sticky state. */
    readonly keySuffixPattern?: RegExp;
    /** Remove URL userinfo from string values by default. 'preserve' opts out; other string secrets and non-plain objects remain outside this policy. */
    readonly urlCredentials?: 'preserve' | 'remove';
}
/**
 * Returns a copy of `config` with secret-bearing leaf values replaced by
 * `'[REDACTED]'` — the shape to hand to a config dump or startup log. The
 * input is never mutated: plain objects and arrays are rebuilt along the walk,
 * while non-plain values (dates, class instances) pass through by reference.
 * URL userinfo is removed from string values by default; query/fragment/path
 * secrets, embedded prose, and non-plain URL instances remain unredacted.
 * Set urlCredentials: 'preserve' to retain the previous string behavior.
 */
export declare function redactConfig<T>(config: T, options?: RedactConfigOptions): T;
//# sourceMappingURL=redactConfig.d.ts.map