/**
 * Redact secret-shaped substrings from a job error message before it is
 * persisted to the `_smrt_jobs.last_error` column.
 *
 * @remarks
 * `last_error` is durable and readable through generated `list`/`get` routes
 * (now tenant-scoped — see {@link "./smrt-job".SmrtJob}). Error messages thrown
 * from a failing job frequently echo back the arguments or environment that
 * caused the failure: a database URL with embedded credentials, a `Bearer`
 * token, an `Authorization` header, an API key, or a `key=value` secret pair.
 * Persisting those verbatim turns a transient failure into a durable credential
 * leak (S5 audit #1402).
 *
 * The policy biases toward over-redaction: matching a benign string is a
 * cosmetic loss, while leaking a credential is a security incident. Patterns are
 * intentionally conservative and order-independent — each is applied globally so
 * multiple secrets in one message are all masked.
 */
/**
 * Mask secret-shaped substrings in an error message.
 *
 * Strictly `string => string`: pass a known message here. For an arbitrary
 * throwable of unknown shape (e.g. a caught `unknown`), call
 * {@link redactErrorForPersistence} instead — it coerces non-`Error` values to
 * a string first. The runtime non-string guard below is defensive depth only;
 * the type contract is that callers supply a string.
 *
 * @param message - Raw error message (e.g. `error.message`).
 * @returns The message with credential-like substrings replaced by
 *   `***REDACTED***`. Empty input is returned unchanged.
 *
 * @example
 * ```ts
 * redactErrorMessage('connect failed: postgres://u:p@db/app')
 * // => 'connect failed: postgres://***REDACTED***@db/app'
 * redactErrorMessage('401 from api: apiKey=<the-key>')
 * // => '401 from api: apiKey=***REDACTED***'
 * ```
 */
export declare function redactErrorMessage(message: string): string;
/**
 * Redact an arbitrary error's message, tolerating non-Error throwables.
 *
 * @param error - Anything thrown (`Error`, string, or unknown).
 * @returns A redacted message string suitable for persistence.
 */
export declare function redactErrorForPersistence(error: unknown): string;
//# sourceMappingURL=error-redaction.d.ts.map