/** Replacement token substituted for any known secret value. Generic on purpose — it must not
 *  reveal WHICH secret matched. */
export declare const REDACTION_PLACEHOLDER = "[REDACTED]";
/**
 * Values shorter than this are NOT recorded. A 1–3 char "secret" would match common substrings and
 * shred unrelated text; real credentials are long. Mirrors GitHub Actions' masking floor. A value
 * this short should not be a secret in the first place — and the structural guarantee (secrets never
 * flow to the LLM by construction) still holds for it; only the belt-and-suspenders scrub is skipped.
 */
export declare const MIN_REDACTABLE_LENGTH = 4;
export interface SecretRedactorOptions {
    placeholder?: string;
    minLength?: number;
}
export declare class SecretRedactor {
    /** Recorded secret values, kept sorted longest-first so a longer secret is replaced before any
     *  shorter secret that is its substring. */
    private recorded;
    private readonly seen;
    private readonly placeholder;
    private readonly minLength;
    constructor(opts?: SecretRedactorOptions);
    /** Number of distinct values currently being redacted. */
    get size(): number;
    /** A snapshot of the recorded secret values (longest-first). Read by the worker to seed a fresh
     *  engine `Redactor` per leaf so the engine loop scrubs the SAME values out of model-bound content. */
    get values(): readonly string[];
    /**
     * Record a resolved secret value so future LLM-bound content has it scrubbed. No-op for values
     * below the length floor or already known. Idempotent.
     */
    record(value: string): void;
    /** Replace every occurrence of every known secret value in `text` with the placeholder. */
    redactText(text: string): string;
    /**
     * Deep-redact a JSON-shaped value: strings are scrubbed, arrays/objects recursed. Non-string
     * primitives pass through (a secret is always a string). Returns the input unchanged when nothing
     * is recorded, so the common no-secrets case is allocation-free.
     */
    redactValue(value: unknown): unknown;
    private redactAt;
}