/**
 * Log Sanitizer for Application-Level Secret Protection
 *
 * Sanitizes secrets from log messages while preserving debugging information.
 * This operates at the APPLICATION layer and only removes secrets that should
 * NEVER appear in any log, anywhere.
 *
 * ARCHITECTURE:
 * - Application layer (this file): Secrets-only sanitization (unconditional)
 * - Pipeline layer (OTel Collector): Tier-based filtering for export
 *
 * Stack traces, emails, file paths are preserved for debugging. The pipeline
 * layer handles redacting these for Tier 2 export in cloud-prem deployments.
 *
 * @see https://github.com/superblocksteam/engineering/blob/main/projects/o11y-refactor/epics/epic-c4-logging-strategy.md
 */
/**
 * Fields that contain secrets and should be stripped from log objects.
 * Only includes actual secret field names - NOT debugging info.
 *
 * Pipeline-layer concerns (AI content, stack traces, PII) are NOT included here.
 * Those are handled by the OTel Collector for tier-based export filtering.
 */
export declare const SECRET_FIELDS: Set<string>;
/**
 * Check if a field name contains secrets using word boundary matching.
 */
export declare function isSecretField(fieldName: string): boolean;
/**
 * @deprecated Use SECRET_FIELDS instead. This export is kept for backward
 * compatibility but now only contains secret fields, not Tier 1 content fields.
 */
export declare const TIER1_FORBIDDEN_LOG_FIELDS: Set<string>;
/**
 * Sanitizes secrets from a log message string.
 * Preserves debugging info (emails, file paths, etc.) for troubleshooting.
 *
 * @param message - The log message to sanitize
 * @returns Message with secrets redacted
 */
export declare function sanitizeLogMessage(message: string): string;
/**
 * Sanitizes secrets within a stack trace while preserving the full trace.
 * Stack traces are essential for debugging - only redact secrets within them.
 *
 * @param stack - The stack trace string
 * @returns Stack trace with secrets redacted but structure preserved
 */
export declare function redactStackTrace(stack: string): string;
/**
 * Recursively sanitizes secrets from an object.
 * Strips secret fields entirely, sanitizes secrets in string values.
 * Preserves debugging info (stack traces, file paths, emails).
 *
 * @param obj - The object to sanitize
 * @param depth - Current recursion depth (default: 0)
 * @returns Object with secrets removed
 */
export declare function sanitizeLogObject<T>(obj: T, depth?: number): T;
/**
 * Sanitizes secrets from an error object.
 * Preserves full stack traces for debugging.
 *
 * @param error - The error to sanitize
 * @returns Error object with secrets redacted
 */
export declare function sanitizeLogError(error: unknown): unknown;
/**
 * Safe JSON stringify with secret sanitization.
 * Handles circular references and non-serializable types.
 * Preserves debugging info (stack traces, file paths, emails).
 *
 * @param obj - Object to stringify
 * @param space - Indentation (optional)
 * @returns JSON string with secrets redacted
 */
export declare function safeJsonStringify(obj: unknown, space?: string | number): string;
//# sourceMappingURL=log-sanitizer.d.ts.map