/**
 * The built-in rule, always available and never configurable.
 *
 * Separate from `isSensitiveKey` on purpose: the driven path needs a floor that no page-supplied
 * config can lower, and the conformance test needs something to compare an unconfigured policy
 * against. Every existing caller wants `isSensitiveKey`.
 */
export declare function defaultIsSensitiveKey(key: string): boolean;
/**
 * An app's additions to (and subtractions from) the default rule.
 *
 * Additive by construction: `keys` can only ever redact MORE, and `allow` only exempts from the
 * DEFAULT rule. There is deliberately no way to replace the default set — a user who could would
 * eventually ship an app that leaks, and Reticle would be the thing that recorded it.
 */
export interface RedactionConfig {
    /**
     * Extra keys to redact. A string matches a key name EXACTLY (case-insensitively) — `'code'` does
     * not redact `codeOwner` — and a RegExp is tested against the key. Use a string unless you need a
     * pattern: only strings cross the bridge (see `wireRedactionKeys`).
     */
    keys?: ReadonlyArray<string | RegExp>;
    /**
     * Keys to exempt from the DEFAULT rule, for the false positives every app has its own version of
     * (`designToken`, an internal `sessionId` that is not a credential). Exact, case-insensitive.
     * Loses to `keys`: an explicit redact instruction beats an exemption.
     */
    allow?: readonly string[];
}
/** A resolved rule. An object rather than a bare function so a caller can hold one per session. */
export interface RedactionPolicy {
    isSensitiveKey: (key: string) => boolean;
}
/**
 * Resolve a config into a rule.
 *
 * `onWarn` fires ONCE here, at build time, rather than per key: the check runs on every serialized
 * key of every event, so a per-key warning would flood the console of the app it is trying to help.
 */
export declare function buildRedactionPolicy(config?: RedactionConfig, onWarn?: (message: string) => void): RedactionPolicy;
export declare function setActiveRedactionPolicy(policy: RedactionPolicy): void;
export declare function resetActiveRedactionPolicy(): void;
/** Whether a key carries a credential, under the policy in force. */
export declare function isSensitiveKey(key: string): boolean;
/**
 * Redact credential-bearing values in a URL so they don't leak into the agent transcript / flow / run
 * artifacts: query params (`?access_token=…`, signed-URL keys), the authority's userinfo, path-embedded
 * tokens (`/reset/<token>`, `/invite/<token>`), and the fragment an OAuth implicit flow uses. The URL is
 * returned byte-for-byte when nothing matched.
 *
 * Lives in core, beside the key rule, because it is a property of the WIRE rather than of one side of
 * it. It was implemented in the browser SDK, which was the only consumer until the driven path began
 * building NET_DETAIL straight from the network stack: those URLs are raw, and a second copy of this
 * heuristic is the worst possible thing to let drift.
 *
 * `isSensitive` defaults to the ambient rule, which is what the browser wants. The server passes its
 * own session policy explicitly, because a daemon serves many apps in one process and has no ambient
 * rule to consult.
 */
export declare function redactUrl(raw: string, isSensitive?: (key: string) => boolean): string;
/**
 * Displayed URL plus, when redaction rewrote it, the raw request for graders.
 *
 * `url` is what the agent reads. `urlRaw` exists only so `urlContains` can still match a public
 * path segment that the heuristic rewrote (`/auth/token/refresh-context`), and so two observations of
 * the same request can be matched to each other. Omitted when nothing changed, so an ordinary request
 * pays nothing.
 */
export declare function netUrlFields(raw: string, isSensitive?: (key: string) => boolean): {
    url: string;
} | {
    url: string;
    urlRaw: string;
};
/** Cap on how many declared keys travel in a hello — a bound, not a limit anyone should reach. */
export declare const MAX_WIRE_REDACT_KEYS = 64;
/** Cap on one declared key's length, so a hello cannot be inflated by a pathological name. */
export declare const MAX_WIRE_REDACT_KEY_LENGTH = 128;
/**
 * The part of a config that may cross the bridge, so the server redacts an app's own credentials on
 * the driven path too — where request bodies are captured raw from the network stack and never pass
 * through the SDK at all.
 *
 * Two deliberate exclusions, and both are the safe direction of the asymmetry:
 *
 *  - **RegExp entries do not travel.** Compiling a pattern that arrived over a socket and running it
 *    against every key of every request body is a ReDoS surface handed to whatever is on the page.
 *    A dropped pattern means the driven path over-redacts relative to the config, never under.
 *  - **`allow` never travels.** It is the only part of the config that REMOVES redaction, so a page
 *    able to send it could quietly un-redact `password` in the daemon's journal for every session.
 *    The driven path keeps the default floor.
 *
 * Both limitations are documented for users in docs/usage.md ("Extending the redaction rules").
 */
export declare function wireRedactionKeys(config?: RedactionConfig): string[];
/** Redact high-confidence secret shapes anywhere in a text/value, independent of any surrounding key. */
export declare function scrubKnownSecrets(text: string): string;