/**
 * Secret redaction for peaks-loop JSONL log lines.
 *
 * a raw secret to disk. We redact at two levels:
 *  1. Field level — when a structured payload contains a key whose
 *     name matches a secret pattern (`api_key`, `password`, `token`,
 *     `Authorization`, etc.), the value is replaced with `<redacted>`.
 *  2. Line level — when a free-form string contains patterns like
 *     `Authorization: Bearer <token>`, `api_key=<value>`, or
 *     `password="<value>"`, the token-shaped value is replaced.
 *
 * Redaction is intentionally conservative: false positives are
 * acceptable (a user can read a redacted line); false negatives are
 * NOT (a leaked token may be pasted into a GitHub issue).
 *
 * The PRD lists the redaction triggers; this module is the only
 * place the regex table lives, so any future addition (e.g. a new
 * `client_secret` key) is a one-line change.
 */
/**
 * Returns true when the given key name should be treated as a
 * secret regardless of the value's shape. Case-insensitive.
 */
export declare function isSecretKey(key: unknown): boolean;
/**
 * Redact a single string value. Returns the original string when
 * it does not look like a credential; returns `<redacted>` when it
 * does. Empty / non-strings return as-is.
 */
export declare function redactValue(value: unknown): unknown;
export declare function redactLine(line: string): string;