/**
 * Path redaction: home dir, username, generic `/home`/`/Users`/`C:\Users`
 * prefixes (POSIX and Windows), and a generic absolute-path-to-basename
 * collapse. Standalone entry point for callers that only need paths gone
 * (e.g. sanitizeError() — an internal error message, not published data).
 */
export declare function redactPaths(text: string): string;
/** IPv4/IPv6, email, SSN, phone, and hostname redaction. */
export declare function redactPii(text: string): string;
/** API keys, tokens, passwords, private keys, and known provider key formats. */
export declare function redactSecrets(text: string): string;
/**
 * Strip obvious secrets/PII/paths before anything gets sent somewhere it
 * shouldn't (a public GitHub issue, an exported pattern file). Not a
 * substitute for careful callers — this is a last-resort net.
 *
 * Order matters: home/user/generic-prefix replacement must run before the
 * generic absolute-path collapse (so a username-bearing path collapses to
 * `<user>`'s neighborhood correctly), and secret-pattern stripping runs
 * before that path collapse too (a secret string that happens to look
 * path-like should still hit the secret patterns first).
 *
 * i-116-redact: secret-pattern stripping now runs BEFORE stripSsnAndPhone(),
 * not after. This is a hardening change, not a fix to any currently-shipped
 * behaviour — verified (reviewer, through the real shipped redact()) that
 * both orders leak identically for every pattern that existed before this
 * item. The shipped keyword patterns use a permissive value class
 * (`[^\s'"]`), which still matches through a `<phone>`/`<ssn>` placeholder,
 * so going second never broke them. This item's new self-identifying-prefix
 * patterns use restrictive classes (e.g. `[A-Za-z0-9-]`) that a placeholder
 * falls outside of, so a value with a phone-shaped digit run in the middle
 * (Slack's `xoxb-<team-id>-<bot-id>-<secret>`, where the IDs are always
 * numeric) would have its PII-mangled remainder no longer match — the
 * secret suffix would then survive, untouched, in the final output. Secrets
 * must get first pass at the text: a cosmetic PII transform must never be
 * able to defeat a security transform, independent of which patterns exist
 * today, because the next pattern added after this one would inherit the
 * same latent hazard otherwise.
 */
export declare function redact(text: string): string;
//# sourceMappingURL=redaction.d.ts.map