/**
 * Redaction shared by every host surface that retains or forwards the output of
 * a model-authored command: background process jobs and monitors.
 *
 * Keeping one implementation is the point. A monitor forwards command output to
 * the model on a schedule, so a second, subtly weaker redactor here would be a
 * standing way to exfiltrate what the process-job path already refuses to show.
 */
export declare function redactProcessOutput(text: string, secrets: readonly string[], truncatedAtEnd?: boolean): string;
export interface StreamingProcessOutputLine<T> {
    readonly text: string;
    readonly value: T;
}
/**
 * Stateful line redaction for output whose secrets may cross physical lines.
 *
 * The queue retains only the suffix that could still become a known secret.
 * Callers may clone it for a non-mutating, fail-closed partial snapshot.
 */
export declare class StreamingProcessOutputRedactor<T> {
    private readonly secrets;
    private readonly minimumSecretPrefix;
    private readonly holdCredentialPrefixes;
    private readonly queue;
    private privateKeyOpen;
    private credentialContinuation;
    constructor(secrets: readonly string[], minimumSecretPrefix?: number, holdCredentialPrefixes?: boolean);
    get pendingCount(): number;
    push(line: string, value: T, truncatedAtEnd?: boolean): readonly StreamingProcessOutputLine<T>[];
    finalize(redactIncompletePrefixes?: boolean): readonly StreamingProcessOutputLine<T>[];
    clear(): void;
    clone(): StreamingProcessOutputRedactor<T>;
    private drain;
}
/**
 * Redaction for output consumed LINE BY LINE, where whole-literal matching
 * against known environment values cannot fire because no single line contains
 * the complete secret.
 */
export declare function redactProcessOutputLine(line: string, secrets: readonly string[], truncatedAtEnd?: boolean): string;
export declare function isPrivateKeyBegin(line: string): boolean;
export declare function isPrivateKeyEnd(line: string): boolean;
/** The longest secret the redactor must be able to see whole to match it. */
export declare function longestSecretBytes(secrets: readonly string[]): number;
/**
 * Every environment value the spawned command can actually observe that is
 * worth treating as a secret in its own output: values the host explicitly
 * injected, anything long enough to be a credential, and anything under a
 * sensitive name.
 */
export declare function processOutputSecrets(overrides: Readonly<Record<string, string | undefined>> | undefined): readonly string[];
/**
 * The narrower set used for model-authored free text such as a description: an
 * arbitrary four-character environment value is far more likely to be an
 * ordinary word there than a leaked credential.
 */
export declare function processDescriptionSecrets(overrides: Readonly<Record<string, string | undefined>> | undefined): readonly string[];
//# sourceMappingURL=process-output-redaction.d.ts.map