/**
 * Keys whose values must be redacted when they appear as JSON properties
 * (`"key": "value"`) or URL-encoded params (`key=value`). Both camelCase and
 * snake_case variants are listed because Okta uses `session_token` in its
 * redirect URL while the rest of the codebase uses `sessionToken`.
 */
export declare const SENSITIVE_KEYS: string[];
/**
 * HTTP header names whose values must be redacted when they appear in
 * `Header-Name: value` form (e.g. log lines printed by HTTP clients, request
 * dumps in test output). Header redaction is line-scoped because header
 * values can contain `=` and `:` characters that would otherwise confuse the
 * URL/JSON patterns.
 */
export declare const SENSITIVE_HEADERS: string[];
/**
 * Redacts sensitive key-value pairs from a string in JSON, escaped-JSON,
 * URL-encoded, cookie, and `Header: value` formats.
 *
 * Replaces:
 * - `"key": "<anything>"` → `"key": "***"` (case-insensitive), at any JSON
 *   escape depth — `"key":"v"`, `\"key\":\"v\"`, `\\\"key\\\":\\\"v\\\"`, … —
 *   which covers request/response bodies and doubly-nested localStorage values
 *   stored in Playwright trace entries.
 * - `"value": "<anything>"` → `"value": "***"` when the enclosing object is a
 *   browser cookie (see `redactCookieValues` — property-order independent),
 *   e.g. `addCookies` params carrying an Okta session cookie.
 * - `key=<anything>` → `key=***` (URL-encoded, value terminates at `&`/whitespace/`"`)
 * - `Header-Name: <rest-of-line>` → `Header-Name: ***` (case-insensitive, line-scoped)
 *
 * @param message - The string to redact sensitive values from
 * @returns {string} The string with sensitive values replaced by `***`
 */
export declare const redactSensitive: (message: string) => string;