/** Shared secret scrubbing for insight previews (command / output / prompt /
 *  conversation owner-only relaxed path).
 *
 *  ReDoS note: the earlier per-file copies used an UNBOUNDED prefix/suffix around
 *  the keyword — `[A-Za-z0-9_-]*(?:token|secret|key|…)[A-Za-z0-9_-]*` — which
 *  backtracked quadratically on keyword-dense input lacking a `=`/`:` separator
 *  (measured ~2.4s on 80KB). Because insight parse runs synchronously inside the
 *  daemon IPC handler, that stalled the single event loop (all Lark dispatch + PTY
 *  IO). Here the quantifiers around the keyword are BOUNDED ({0,48}) so per-start
 *  cost is constant → the scan is linear in input length, and callers additionally
 *  cap the bytes scrubbed via safeScrubAndTruncate. */
/** Scrub known secret shapes. Linear in input length (bounded quantifiers).
 *  Callers should bound input length first (see safeScrubAndTruncate). */
export declare function scrubSecrets(text: string): string;
/** Bound the bytes scrubbed AND displayed to `max` (+overscan), with an absolute
 *  backstop. The discarded tail is never shown, so leaving it unscrubbed is safe;
 *  this keeps redaction work O(displayed length) regardless of raw size. */
export declare function safeScrubAndTruncate(raw: string, max: number): {
    text: string;
    truncated: boolean;
};
//# sourceMappingURL=scrub.d.ts.map