/**
 * Removes credential material from values before they are logged or thrown.
 *
 * The failure this exists for is not hypothetical. `RequestHandler.getRequestConfig`
 * builds `{auth: this._session, ...}` and the next line logs that whole object at
 * debug level, so every request wrote a live session — cookies, user token, or an
 * OAuth access token — into `logs/app-debug.log`. That is what forced the `^logs/`
 * allowlist in `.gitleaks.toml`.
 *
 * Redaction is by KEY, not by value. A value-based approach needs a registry of the
 * secrets currently in play, which does not exist at the point a Winston format runs.
 * Key-based matching costs nothing and catches the shape of the problem: secrets in
 * this codebase always arrive under a recognisable name (`auth`, `cookie`,
 * `access_token`, …) because they come from the SDK's own session objects.
 */
export declare const REDACTED = "[redacted]";
/**
 * Removes credential material from a log message string.
 *
 * The leak this exists for: `ScriptTracer` logged `Session ID from debugger/start:
 * ${token}` at INFO level, so a live session token landed in `app-info.log` on every
 * trace. `AMBClient` did the same with session cookies, truncated to 80 characters —
 * truncation is not redaction, and a partial cookie is still a cookie.
 *
 * Deliberately biased toward over-redaction. Losing `30s` from `token refresh: 30s`
 * costs a diagnostic; leaking a session token costs an instance.
 */
export declare function redactMessage(message: string): string;
export declare function isSecretKey(key: string): boolean;
/**
 * Returns a copy of `value` with every secret-shaped key replaced by `[redacted]`.
 *
 * Never mutates the input — callers are logging live objects that the rest of the
 * request still depends on. Cycles, depth overruns, and unserializable values all
 * degrade to a placeholder string rather than throwing: a logger that throws is worse
 * than one that omits a field.
 */
export declare function redactValue(value: unknown, depth?: number, seen?: WeakSet<object>): unknown;
/**
 * Strips credential material from an error **in place** and returns it.
 *
 * Used before rethrowing, so the error that reaches a consumer carries nothing
 * sensitive. Deliberately mutates rather than returning a replacement: consumers do
 * `instanceof` checks against it (StaleInstanceError, and the CLI's remediation
 * duck-typing), and rebuilding the error would break both and discard the stack.
 *
 * This matters more since sessions stopped being flattened at the throw sites: an
 * error now reaches callers with `config` and `response` intact, and their loggers do
 * not have core's redaction format.
 */
export declare function stripSecretsFromError<T>(error: T): T;
/**
 * Returns a plain object describing `error` with credential material removed.
 *
 * Kept structural rather than returning a rebuilt Error: this is for logging and for
 * handing to a consumer, and a plain object cannot be mistaken for something throwable
 * that has lost its prototype.
 */
export declare function redactError(error: unknown, depth?: number, seen?: WeakSet<object>): Record<string, unknown>;