/**
 * Credential masking for CloudFormation FailureAnalysis at the producer
 * boundary. The analysis embeds raw CloudFormation `statusReason` strings
 * (`rootCause.reason`, `rootCause.resource.statusReason`, each
 * `affectedResources[].statusReason`) which can carry credential fragments —
 * a failed `GetSecretValue`, a connection string in an error body, etc.
 *
 * The engine masks the analysis once, here, before it reaches any sink
 * (the `onFailureAnalysis` callback, `DeployResult.failureAnalysis`, the file
 * event log, and the webapp's persisted column), so no consumer has to re-mask.
 *
 * `summary`, `dependencyChain`, `remediation`, `errorPattern` and the resource
 * identifiers (`logicalId`, `resourceType`, `physicalId`) are names/canned text,
 * not credential values, so they pass through unchanged (cf. the
 * "values, not identifiers" masking rule).
 */
import type { FailureAnalysis } from "./CloudFormationFailureAnalyser.js";
export declare function maskFailureAnalysis(analysis: FailureAnalysis): FailureAnalysis;