export declare const SECRET_PATTERNS: RegExp[];
export declare const LOCAL_PATH_PATTERNS: Array<[RegExp, string]>;
/** True if the text contains any secret-shaped token or known local path. */
export declare function containsSensitive(text: string): boolean;
/** Redact secrets to [REDACTED_SECRET] and local paths to their path labels. */
export declare function redactText(text: string): string;
/** Redact every sensitive match (secrets and paths) to a single [REDACTED_SECRET] label. */
export declare function redactToSecretLabel(text: string): string;
/**
 * Label a path relative to the run's target cwd, or redact it. Returns
 * "[target-cwd]" for the root itself, "[target-cwd]/<rel>" for a descendant, and
 * a redacted form for anything outside the root or a non-absolute value.
 */
export declare function publicPathForTrace(value: string, rootCwd: string): string;
/**
 * A redacted screenshot safe to persist to a public run bundle. `buffer` is
 * always a re-encoded thumbnail, never the source bytes.
 */
export interface RedactedScreenshot {
    /** Public-safe PNG bytes: a downscaled, blurred thumbnail or a placeholder. */
    buffer: Buffer;
    /** How the frame was redacted. Today always "blurred" ("ocr_scrubbed" is reserved). */
    mode: "blurred";
    /** Width of the emitted thumbnail (not the source). */
    width: number;
    /** Height of the emitted thumbnail (not the source). */
    height: number;
    /**
     * True when the source PNG decoded and was downscaled+blurred. False when
     * redaction fell back to a neutral placeholder (non-PNG input, decode failure,
     * or any error). `buffer` is public-safe either way.
     */
    decoded: boolean;
}
export interface RedactScreenshotOptions {
    /**
     * Longest emitted edge in pixels. Clamped to [1, 128]: a caller may request a
     * SMALLER (safer) thumbnail but never a larger one, so no call site can widen
     * the frame back into legibility. Default 96. Blur is not a caller knob: it is
     * an internal safety floor computed from the output size.
     */
    maxWidth?: number;
}
/**
 * Redact a screenshot to a public-safe thumbnail. Fail-closed: any decode or
 * processing failure yields an opaque placeholder, never the source frame.
 */
export declare function redactScreenshot(input: Buffer | Uint8Array, options?: RedactScreenshotOptions): RedactedScreenshot;
/** Stable short content digest (sha256 hex, first `length` chars; default 12). */
export declare function digestText(text: string, length?: number): string;
/** Last `maxChars` of a string (the whole string when shorter). No redaction. */
export declare function tailText(value: string, maxChars: number): string;
/**
 * A redacted, ellipsis-prefixed tail of captured output for a (public-bound)
 * message field. Pattern-redacts the FULL text BEFORE truncating: slicing a tail
 * first could cut through a secret's prefix (e.g. drop "sk-proj-") and defeat the
 * pattern matcher on the remainder. Callers should literal-scrub known
 * provisioned values first; this is the pattern pass. Empty output -> "(no output)".
 */
export declare function redactedTail(text: string, maxChars: number): string;
/**
 * A log-safe reference to a raw prompt: a placeholder string, a stable digest,
 * and the length. Proves which prompt was used without persisting its text.
 */
export declare function promptForLog(raw: string): {
    placeholder: string;
    digest: string;
    length: number;
};
export interface ScreenshotMeta {
    /** Optional smaller-only thumbnail width (clamped to the safe ceiling). */
    maxWidth?: number;
    /** Free-form label for logs (e.g. "turn-03-call-01"). Never enters the pixels. */
    label?: string;
}
export interface RedactionHooks {
    redactText(text: string): string;
    publicPath(value: string, rootCwd: string): string;
    redactScreenshot(buffer: Buffer | Uint8Array, meta?: ScreenshotMeta): Promise<{
        buffer: Buffer;
        method: "blurred" | "ocr_scrubbed";
    }>;
    promptForLog(raw: string): {
        placeholder: string;
        digest: string;
        length: number;
    };
}
/** The default hooks wired into every actor: redaction.ts is the source of truth. */
export declare const defaultRedactionHooks: RedactionHooks;