/**
 * Write-path secret scrubbing. `scrubSecrets` removes credential material from
 * text before it is persisted (run stdout/stderr/error, goal evidence, raw
 * model responses). Display-layer truncation/redaction lives in format.ts;
 * this module is about never writing recoverable secrets to disk at all.
 *
 * The function is idempotent (`scrubSecrets(scrubSecrets(x)) === scrubSecrets(x)`)
 * and linear over the input, so it stays fast on multi-hundred-KB outputs.
 */
/**
 * Replace credential tokens in `text` with "[SCRUBBED]". Idempotent and safe
 * to run on JSON-encoded payloads (replacements never introduce quotes).
 */
export declare function scrubSecrets(text: string): string;
/**
 * Recursively scrub the string leaves of a JSON-serializable value. Run this
 * BEFORE `JSON.stringify` when persisting structured payloads (goal evidence,
 * raw model responses): stringify escapes quotes, which would otherwise hide
 * quoted secrets from the flat text patterns above.
 */
export declare function scrubSecretsDeep<T>(value: T): T;
/**
 * True when `value` is exactly a redaction placeholder, not text containing
 * one. Returns a plain boolean rather than a `value is string` predicate on
 * purpose: callers ask this about a value they have already narrowed to a
 * string, and a predicate would narrow the *false* branch to `never`.
 */
export declare function isRedactionPlaceholder(value: unknown): boolean;