/**
 *
 * "username path segment" extension):
 *
 *   1. cookie-redaction              — `Cookie: <name>=<value>` / `Set-Cookie: ...`
 *   2. token-redaction               — Bearer tokens, JWTs, API keys (sk-/ghp-/... prefixes)
 *   3. sso-url-redaction             — SSO redirect URLs with embedded tokens (`?token=`,
 *                                       `?code=`, `#access_token=`)
 *   4. personal-email-redaction      — RFC-5322-shaped personal emails
 *   5. username-path-segment-redaction — `/Users/<name>/` and `C:\\Users\\<name>\\`
 *                                       path segments (only the username segment,
 *                                       not the whole path)
 *
 * Sanitize contract:
 *   - Pure (no IO). `sanitizeFixture(input: string)` returns the redacted
 *     string + a `SanitizationReport`.
 *   - `passed: true` only when ALL rules have been applied. The capture
 *     CLI refuses to write a fixture with `passed: false`.
 *   - Each rule produces a stable replacement token (`<REDACTED-<rule}>`)
 *     so the test suite can grep for redaction without depending on
 *     the original (potentially sensitive) values.
 *
 * Why a separate service (not inline in capture CLI):
 *     and 5 sanitize rules need 5+ test cases per rule. Keeping the
 *     logic in a service makes the tests trivial.
 *   - Re-usable by future capture tools (`peaks fixture redact`,
 *     `peaks fixture snapshot-share`) without forking logic.
 */
import { z } from 'zod';
export type SanitizeRuleName = 'cookie-redaction' | 'token-redaction' | 'sso-url-redaction' | 'personal-email-redaction' | 'username-path-segment-redaction';
export declare const SANITIZE_RULE_NAMES: ReadonlyArray<SanitizeRuleName>;
/**
 * A single sanitize rule is a `name + regex + replacement`. Rules are
 * applied in array order; later rules see the output of earlier ones.
 * This matters for `sso-url-redaction` (runs after `token-redaction`
 * so the token in `?token=...` is not double-redacted).
 */
export interface SanitizeRule {
    readonly name: SanitizeRuleName;
    readonly pattern: RegExp;
    readonly replacement: string;
}
export declare const SANITIZE_RULES: ReadonlyArray<SanitizeRule>;
export declare const SanitizationIssueSchema: z.ZodObject<{
    rule: z.ZodString;
    match: z.ZodString;
    position: z.ZodNumber;
}, z.core.$strip>;
export declare const SanitizationReportSchema: z.ZodObject<{
    passed: z.ZodBoolean;
    rulesApplied: z.ZodArray<z.ZodEnum<{
        "cookie-redaction": "cookie-redaction";
        "token-redaction": "token-redaction";
        "sso-url-redaction": "sso-url-redaction";
        "personal-email-redaction": "personal-email-redaction";
        "username-path-segment-redaction": "username-path-segment-redaction";
    }>>;
    issues: z.ZodArray<z.ZodObject<{
        rule: z.ZodString;
        match: z.ZodString;
        position: z.ZodNumber;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type SanitizationIssue = z.infer<typeof SanitizationIssueSchema>;
export type SanitizationReport = z.infer<typeof SanitizationReportSchema>;
/**
 * Apply all sanitize rules in order. Returns the redacted string and
 * a structured report. `passed` is `true` iff every rule from
 * `SANITIZE_RULE_NAMES` was applied (which it always is — the boolean
 * exists so future rules can short-circuit, and to give the CLI a
 * consistent contract surface).
 *
 * Pure function: no IO, no side effects. Safe to call in a tight loop.
 */
export declare function sanitizeFixture(input: string): {
    redacted: string;
    report: SanitizationReport;
};
/**
 * Sanitize + structural sanity check. Refuses to produce a `passed:
 * true` report if the redacted output is empty, has zero newlines, or
 * is identical to the input AND the input contains any of the
 * forbidden patterns. This guards against accidental no-op sanitization.
 */
export declare function sanitizeFixtureStrict(input: string): {
    redacted: string;
    report: SanitizationReport;
};