/**
 * Secret redaction engine.
 *
 * Detects and replaces sensitive values with {{VARNAME}} template placeholders
 * so they are NEVER stored in the DB. The config becomes a template that can
 * be rendered with real values at apply-time.
 *
 * Strategy:
 *  1. Key-name matching — if an assignment's LHS looks like a secret key name
 *  2. Value-pattern matching — known token formats (npm, GitHub, Anthropic, etc.)
 *     regardless of key name
 */
export interface RedactResult {
    content: string;
    redacted: RedactedVar[];
    isTemplate: boolean;
}
export interface RedactedVar {
    varName: string;
    line: number;
    reason: string;
}
export type RedactFormat = "shell" | "json" | "toml" | "ini" | "markdown" | "text" | "yaml";
export declare function redactContent(content: string, format: RedactFormat): RedactResult;
/** Detect secrets without modifying content. Returns list of findings. */
export declare function scanSecrets(content: string, format: RedactFormat): RedactedVar[];
/** Returns true if content contains any detectable secrets. */
export declare function hasSecrets(content: string, format: RedactFormat): boolean;
//# sourceMappingURL=redact.d.ts.map