/**
 * Redact secrets from connector output before it leaves the worker.
 *
 * Patterns are deliberately broad — false positives are preferred to leaking a
 * real credential into the runs table. Add new patterns here when a connector
 * surfaces a new sensitive shape.
 */
export declare function redactOutput(text: string): string;
/**
 * Streaming redactor for live tee to parent stdout/stderr. Buffers up to the
 * last newline so that secrets split across stream chunk boundaries — for
 * example "Authorization: Bear" + "er abc..." in two `data` events — still
 * get matched by `redactOutput()`. The persisted `output_tail` already runs
 * `redactOutput()` over the full ring-buffer string and is unaffected; this
 * class exists solely to make the live-forwarded stream as safe as the
 * persisted tail.
 *
 * `flush()` MUST be called on stream end to release any trailing partial
 * line; otherwise its (redacted) content is dropped from the live tee but
 * still appears in the persisted tail.
 */
export declare class StreamRedactor {
    private carryover;
    private static readonly MAX_BUFFER;
    process(chunk: string, emit: (redacted: string) => void): void;
    flush(emit: (redacted: string) => void): void;
}
//# sourceMappingURL=redact.d.ts.map