//#region ../ai/src/security/redact.d.ts
/**
 * Default set of sensitive key fragments (matched case-insensitively as
 * substrings of an object key). Covers the secrets that leak through
 * recorded requests, error causes, and trace payloads: auth headers, API
 * keys, cookies, tokens, passwords, and private keys.
 */
declare const DEFAULT_SENSITIVE_KEYS: readonly string[];
/** HTTP header names always stripped from a serialized error/cause. */
declare const SENSITIVE_HEADERS: readonly string[];
type RedactOptions = {
  /** Extra key fragments to redact, merged with {@link DEFAULT_SENSITIVE_KEYS}. */keys?: string[]; /** Replacement for a redacted value. Default `"[redacted]"`. */
  placeholder?: string; /** Maximum recursion depth before bailing out. Default `8`. */
  maxDepth?: number;
};
/**
 * Deep-copy `value` with any property whose KEY matches a sensitive
 * fragment replaced by the placeholder. Arrays are walked element-wise;
 * circular references and over-deep trees collapse to the placeholder.
 * Primitives pass through untouched (redaction is key-driven, not
 * value-driven — it never guesses at a bare string being a secret).
 *
 * Shared by VCR cassettes (S2), Panoptic content capture, and the error /
 * cause serializer (S4) so there is ONE redaction policy, not three.
 */
declare function redact<T>(value: T, options?: RedactOptions): T;
/**
 * Strip sensitive HTTP headers from a `Headers` instance or a plain
 * header record, returning a redacted plain object. Header names are
 * matched case-insensitively against {@link SENSITIVE_HEADERS}.
 */
declare function redactHeaders(headers: Headers | Record<string, unknown> | undefined, placeholder?: string): Record<string, unknown>;
/**
 * Scrub secrets that appear in free-form text — error messages, stack
 * traces, exported log lines. Complements {@link redact} (which is key-
 * driven and can't see a token embedded in a string). Used by the trace /
 * error serializer (S4) before a message or stack is stored or exported.
 */
declare function scrubSecrets(text: string): string;
/**
 * Serialized, secret-free view of an error. `stack` is omitted by default
 * (it can embed local paths, endpoints, and tokens); pass
 * `includeStack: true` only for a trusted local sink. The retained
 * `cause` is deep-redacted via {@link redact}, so a raw provider SDK error
 * carrying `Authorization` / `x-api-key` on `cause.headers` is sanitized.
 */
type RedactedError = {
  name: string;
  message: string;
  code?: string;
  cause?: unknown;
  stack?: string;
};
declare function redactError(error: unknown, options?: {
  includeStack?: boolean;
} & RedactOptions): RedactedError;
//#endregion
export { DEFAULT_SENSITIVE_KEYS, RedactOptions, RedactedError, SENSITIVE_HEADERS, redact, redactError, redactHeaders, scrubSecrets };
//# sourceMappingURL=redact.d.mts.map