/**
 * Aegis Logger — structured logging with pino.
 *
 * Central logger factory for all Aegis modules. Provides:
 * - Structured JSON output in production, pretty-print in development
 * - Declarative field-level redaction (secrets, tokens, passwords)
 * - Pattern-based scrubbing for credential-like strings in log values
 * - Request correlation IDs via child loggers
 * - stderr output support (required for MCP stdio transport)
 *
 * SECURITY: This is a security product — secrets must NEVER appear in logs.
 * The logger enforces this through three layers:
 *   1. Pino's `redact` option censors known sensitive field paths
 *   2. Custom serializers scrub credential-like patterns from string values
 *   3. The `safeMeta()` helper strips sensitive fields from ad-hoc objects
 */
import pino from 'pino';
export type LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'fatal' | 'silent';
export interface LoggerOptions {
    /** Minimum log level (default: 'info') */
    level?: LogLevel;
    /** Module name — appears as `module` field in every log entry (e.g. 'gate', 'mcp', 'vault') */
    module?: string;
    /** Use pretty-print instead of JSON (default: auto-detect from NODE_ENV) */
    pretty?: boolean;
    /** Write to stderr instead of stdout (required for MCP stdio transport) */
    stderr?: boolean;
}
/**
 * Scrub credential-like patterns from a string value.
 * Replaces matches with [REDACTED] to prevent accidental exposure.
 */
export declare function scrubString(value: string): string;
/**
 * Strip sensitive fields from an arbitrary object before logging.
 * Use this for ad-hoc metadata objects that aren't covered by pino's redact paths.
 */
export declare function safeMeta(obj: Record<string, unknown>): Record<string, unknown>;
/**
 * Create a pino logger instance for an Aegis module.
 *
 * @example
 * ```ts
 * const logger = createLogger({ module: 'gate', level: 'debug' });
 * logger.info({ service: 'slack', method: 'GET' }, 'Request proxied');
 *
 * // Child logger with request correlation ID
 * const reqLogger = logger.child({ requestId: generateRequestId() });
 * reqLogger.info({ status: 200 }, 'Response sent');
 * ```
 */
export declare function createLogger(options?: LoggerOptions): pino.Logger;
/**
 * Generate a unique request correlation ID.
 * Included in all log entries for a given request, and stored in Ledger records.
 */
export declare function generateRequestId(): string;
//# sourceMappingURL=logger.d.ts.map