/**
 * Rewrites a Playwright trace.zip in place with sensitive values stripped.
 *
 * Two surfaces carry secrets in a retained trace:
 *
 * 1. The `.trace`/`.network`/`.stacks` JSONL streams — e.g. the `page.goto`
 *    against `/auth/manager-classic#session_token=...` records the full URL as
 *    the action argument, and API-call params are inlined as `jsonData`. The
 *    `login()` cache-hit path also replays the cached storageState here via
 *    `addCookies` (the Okta session cookie, under the generic `value` key) and
 *    `addInitScript` (the `okta-token-storage` access/id/refresh tokens, nested
 *    two escape levels deep) — both handled by `redactSensitive`'s cookie and
 *    escape-depth-agnostic rules.
 * 2. The hashed `resources/<sha1>` entries — Playwright stores network
 *    request/response *bodies* here. The `login()` slow path POSTs the account
 *    password to `/api/v1/authn`, so that body — carrying the cleartext
 *    password — is retained as a resource and rendered verbatim in the Trace
 *    Viewer's request panel. Redacting only the streams (the previous behaviour)
 *    left this copy readable.
 *
 * Streams are always redacted as text. Resource entries are redacted only when
 * they are lossless UTF-8 text (see `asLosslessUtf8`), so binary resources
 * (screenshots, fonts) are never touched. Entries with no sensitive substring
 * are left as-is to avoid needless rewrites.
 */
export declare const redactTraceFile: (filePath: string) => Promise<void>;