/**
 * Structured, redacting logger. The framework logs through this interface so
 * secrets/PII are scrubbed once, centrally (per the project's logging rule), not at
 * each call site. Bring your own by passing `logger` to `server()`.
 */
export type LogFields = Record<string, unknown>;
export interface Logger {
    debug(message: string, fields?: LogFields): void;
    info(message: string, fields?: LogFields): void;
    warn(message: string, fields?: LogFields): void;
    error(message: string, fields?: LogFields): void;
}
/**
 * Tunes redaction. Key-name redaction always runs; the rest is **opt-in**:
 * - `keyParts` - extra case-insensitive key fragments, added to the built-in denylist.
 * - `valuePatterns` - regexes matched against string **values** *and* the log message; each match is
 *   replaced with the placeholder. This is the value-scanning hook for secrets that land in a value or
 *   message (e.g. `err.message`), which key-name redaction can't catch. Off unless provided - the
 *   default path does no value scanning, so it stays allocation-light. See {@link commonSecretPatterns}.
 * - `placeholder` - the replacement string (default `[REDACTED]`).
 */
export interface RedactOptions {
    readonly keyParts?: readonly string[];
    readonly valuePatterns?: readonly RegExp[];
    readonly placeholder?: string;
}
/**
 * A conservative, high-signal set of patterns for {@link RedactOptions.valuePatterns} - opt in by
 * passing it (or a subset) to `jsonLogger`/`redactLogFields`. Covers bearer tokens, JWTs, emails, and a
 * few well-known key formats (Stripe, GitHub, AWS access-key ids). Chosen to minimize false positives;
 * add your own (e.g. internal id formats) as needed. Every pattern is global so all matches are scrubbed.
 */
export declare const commonSecretPatterns: ReadonlyArray<RegExp>;
/**
 * Deep-copy `fields`, replacing values under sensitive keys with the placeholder; cycle-safe. With
 * `options.valuePatterns`, also scans string values for those patterns (opt-in). Without options, this
 * is pure key-name redaction (the long-standing default).
 */
export declare function redactLogFields(fields: LogFields, options?: RedactOptions): LogFields;
/**
 * The default logger: one redacted JSON object per line. `write` is injectable for tests or
 * alternative sinks (defaults to stderr). `options` tunes redaction - pass `valuePatterns` (e.g.
 * {@link commonSecretPatterns}) to also scrub secrets embedded in values + the message. Framework keys
 * (`level`, `message`, `time`) always win over user fields of the same name.
 */
export declare function jsonLogger(write?: (line: string) => void, options?: RedactOptions): Logger;
/** Discards everything - for tests, or when log output is handled elsewhere. */
export declare const silentLogger: Logger;
//# sourceMappingURL=logger.d.ts.map