/**
 * Credential redaction for CI variable values.
 *
 * Depot returns CI *variable* values verbatim (only secret values are withheld server-side), and
 * variables get misused as secret storage. Anything that reads like a credential is replaced with
 * a placeholder before it reaches the model, and the rule that fired is reported so the caller
 * still learns that the value exists.
 *
 * The tool exists so an agent can confirm that a variable holds what it expects, so a false
 * positive costs almost as much as a false negative. Five rules run in order, most specific first:
 *
 *   1. name      — a whole segment of the variable name is a credential word (KEY, TOKEN, PWD…),
 *                  unless the name ends in a path/flag/id-like suffix (_PATH, _URL, _TIMEOUT…).
 *   2. pattern   — a vendor token format appears anywhere in the value (ghp_, AKIA, eyJ…, PEM).
 *   3. structure — the value carries a credential syntactically: `://user:pass@host`, or a
 *                  `password=` / `token:` style assignment with a non-placeholder value.
 *   4. length    — more than 512 characters with no whitespace: a blob, not configuration.
 *   5. entropy   — an alphanumeric run of 20+ characters looks random (Shannon entropy and
 *                  character-class churn both high), and the value is not a URL, path, image
 *                  reference, semver, or digest, and not a git SHA under a SHA/COMMIT-like name.
 *
 * Every regular expression here is linear in the value length: no nested quantifiers, and every
 * variable-length run that must be followed by a literal is bounded.
 */
export type RedactionReason = 'name' | 'pattern' | 'structure' | 'length' | 'entropy';
export type RedactionResult = {
    readonly value: string;
    readonly redacted: true;
    readonly reason: RedactionReason;
} | {
    readonly value: string;
    readonly redacted: false;
    readonly reason: undefined;
};
export declare function redactValue(name: string, value: string): RedactionResult;
//# sourceMappingURL=redact.d.ts.map