/**
 * Heuristic: does this STRING look like a secret, independent of the key it's stored under?
 *
 * Conservative by construction — precision is favoured over recall because over-redacting a legitimate
 * value in a score/genome dump is a real (if smaller) cost:
 *   1. a known provider token prefix (sk-/ghp_/AKIA/AIza/JWT/PEM/…) — high confidence, OR
 *   2. a generic ≥40-char base64/token run that is MIXED-CASE alphanumeric (letters+digits, upper+lower).
 *
 * The mixed-case+digit requirement in (2) deliberately EXCLUDES lowercase-hex git SHAs, uppercase-hex
 * digests, and dashed UUIDs — all common NON-secret identifiers — so we don't redact them.
 */
export declare function looksLikeSecretValue(s: unknown): boolean;
export interface RedactOptions {
    /** Redact a value when its KEY name matches (the existing behaviour of every call site). */
    keyRe: RegExp;
    /** The replacement token — kept per-site (`<redacted>` for bundles, `[REDACTED]` for score/genome/threat). */
    replacement: string;
}
/**
 * Deep-copy `value`, redacting (a) any object value whose KEY matches `keyRe`, and (b) any string
 * value that `looksLikeSecretValue` — anywhere in the tree, including a bare top-level string.
 * Non-string primitives pass through. Pure (no I/O); safe to run on untrusted manifest/config data.
 */
export declare function redactSecretsDeep(value: unknown, opts: RedactOptions): unknown;
//# sourceMappingURL=redact.d.ts.map