/**
 * Secret redaction — the single source of truth for scrubbing provider API keys
 * and other credentials out of EVERY server output channel.
 * change: add-secret-redaction-boundary
 *
 * mcp-security "Secret Confinement Across All Output Paths" requires that a key
 * read for an LLM call never appears in a tool result, telemetry event, log line,
 * or written artifact — extending mcp-quality's error-text sanitization to all
 * channels. This module backs both `sanitizeMcpError` (error text) and the deep
 * `redactSecrets` walker used on structured payloads (telemetry, echoed config).
 *
 * Kept dependency-free so any layer (utils, telemetry, logger) can import it
 * without an import cycle.
 */
export type SecretKind = 'api-key' | 'authorization' | 'cloud-credential' | 'connection-string' | 'jwt' | 'private-key' | 'secret-field';
export interface RedactionDisclosure {
    count: number;
    kinds: SecretKind[];
}
export interface RedactionResult<T> {
    value: T;
    redactions: RedactionDisclosure;
}
/** Redact credential-shaped substrings from a single string. */
export declare function redactSecretString(s: string): string;
/** Redact credential-shaped spans and return a typed, deterministic disclosure receipt. */
export declare function redactSecretText(s: string): RedactionResult<string>;
/**
 * Deep-redact a value before it leaves the server on a non-error channel:
 * - strings → credential-shaped substrings replaced;
 * - object fields whose KEY name denotes a secret → value replaced with `[REDACTED]`;
 * - arrays/objects → walked recursively.
 * Returns a redacted copy; the input is not mutated. Cycle-safe: a back-reference resolves
 * to the already-created redacted twin of the visited node, never to the original — so the
 * output graph never embeds an un-scrubbed subtree.
 */
export declare function redactSecrets<T>(value: T, _seen?: WeakMap<object, unknown>): T;
/**
 * Deep-redact a structured value while counting every replaced span. This is used at
 * disclosure-bearing boundaries; the compatibility `redactSecrets` API above intentionally
 * retains its historical untyped marker and return shape for telemetry and error callers.
 */
export declare function redactSecretsWithReport<T>(value: T, typed?: boolean): RedactionResult<T>;
//# sourceMappingURL=secret-redaction.d.ts.map