/**
 * Secret / credential redaction for structured log context.
 *
 * Defense-in-depth (#1989): the logger, the error-logging path, and the
 * observability log buffer all accept arbitrary `context`/`data` objects from
 * callers and serialize them to log sinks. There is no guarantee a caller
 * never hands us a tokens object, an `Authorization` header bag, or a request
 * body with a password field. This pass masks values whose *key* looks like a
 * credential before serialization, so an accidental
 * `logger.info("...", { authorization: token })` cannot leak the secret.
 *
 * Sensitive keys are masked and every string value is scrubbed for credentials
 * embedded in URL userinfo, query parameters, or fragment parameters. The
 * deny-list errs toward over-redaction — masking a benign `tokenCount` is
 * acceptable; leaking a real token is not. The traversal fails *closed*: on a
 * cycle, depth overflow, or a throwing getter it returns {@link REDACTED}
 * rather than risk emitting an unredacted object.
 */
/** Replacement value substituted for any sensitive field. */
export declare const REDACTED = "[REDACTED]";
/**
 * Replace every non-overlapping occurrence of a trusted path in untrusted text.
 *
 * Comparison treats slash and backslash as equivalent. Windows drive and UNC
 * paths additionally use ASCII-only case folding, matching Windows path
 * identity without locale-sensitive conversion. The linear-time matcher keeps
 * the path literal: regex syntax in either input cannot change what matches.
 */
export declare function redactPathFromText(input: string, path: string, replacement: string): string;
/**
 * Whether a context key names a credential and should have its value masked.
 *
 * Uses substring matching on a normalized key, so `clientSecret`,
 * `x-api-key`, and `refresh_token` all match while benign words that merely
 * *contain* a pattern as a separate token (e.g. `author`) do not — `author`
 * normalizes to `author`, which contains none of the patterns.
 */
export declare function isSensitiveKey(key: string): boolean;
export type RedactedValue = string | number | boolean | null | RedactedValue[] | {
    [key: string]: RedactedValue;
};
/**
 * Returns a redacted copy of `context` while preserving the established source
 * and runtime value shapes. Any property whose key is {@link isSensitiveKey}
 * is replaced with {@link REDACTED}; nested records and arrays are traversed,
 * while primitives and scalar-serializing objects retain their original types.
 * The input is never mutated.
 *
 * Use {@link redactForSerialization} at JSON/logging boundaries where BigInt,
 * functions, symbols, and custom `toJSON` implementations must be normalized.
 */
export declare function redactSensitive<T>(context: T): T;
/**
 * Returns a JSON-safe redacted snapshot of `context`. Sensitive keys are
 * masked, nested values are traversed, BigInts become decimal strings,
 * non-finite numbers become `null`, and unsupported or unreadable values fail
 * closed. Objects with `toJSON` are snapshotted exactly once before redaction.
 */
export declare function redactForSerialization(context: unknown): RedactedValue;
/**
 * Strip credentials from URL-shaped strings so they can be safely emitted in
 * free-form text (error messages, stacks, lifted `request_url` fields). Unlike
 * {@link redactSensitive}, which is key-based, this scrubs secrets embedded in
 * the *value* itself:
 *
 * - URL userinfo: `https://user:password@example.test/path` -> `https://user:[REDACTED]@example.test/path`
 * - sensitive query params: `?access_token=abc` -> `?access_token=[REDACTED]`
 * - credential assignments: `refreshToken=abc` -> `refreshToken=[REDACTED]`
 * - common provider tokens: `Using token sk-...` -> `Using token [REDACTED]`
 *
 * It is intentionally tolerant: it operates on any string (a DSN, a Mongo URI,
 * an axios error message containing a URL) via regex rather than requiring a
 * parseable URL, so malformed or partial URLs in error text are still scrubbed.
 * Strings without credential-shaped content pass through unchanged.
 */
export declare function sanitizeUrlCredentials(input: string): string;
/**
 * Return the URL form safe to attach to observability span attributes.
 *
 * Span attributes bypass the logger's structured redaction pass, so `http.url`
 * must not include query strings, fragments, or URL userinfo. This intentionally
 * strips every query parameter instead of selectively redacting credential-like
 * names because cache keys and callback state can be sensitive even when the
 * parameter name is not obviously a credential.
 */
export declare function sanitizeUrlForSpan(input: string): string;
/**
 * Apply {@link sanitizeUrlCredentials} to the `name`, `message`, and `stack` of a
 * serialized-error-shaped object, returning a new object. Used by the logger's
 * JSON and text paths so errors carrying DSNs, Mongo URIs, or
 * `?access_token=`-bearing URLs do not leak credentials (the serialized error
 * bypasses the key-based redactor). Returns the input unchanged when falsy.
 */
export declare function sanitizeSerializedError<T extends {
    name?: unknown;
    message?: unknown;
    stack?: unknown;
} | undefined>(error: T): T;
//# sourceMappingURL=redact.d.ts.map