/**
 * @param {unknown} key
 * @returns {boolean}
 */
export function isSecretKey(key: unknown): boolean;
/**
 * @param {unknown} name
 * @returns {boolean}
 */
export function isValidEnvironmentName(name: unknown): boolean;
/**
 * @param {unknown} key
 * @param {unknown} value
 * @returns {string}
 */
export function redactValue(key: unknown, value: unknown): string;
/**
 * @param {Record<string, string>} [env]
 * @returns {Record<string, string>}
 */
export function redactEnv(env?: Record<string, string>): Record<string, string>;
/**
 * @param {string} text
 * @param {string[]} [knownSecrets]
 * @returns {string}
 */
export function redactText(text: string, knownSecrets?: string[]): string;
/**
 * Incrementally redacts a command output stream without ever emitting a
 * possibly-incomplete sensitive tail.
 *
 * Secret assignments (`KEY=value`) and credential URLs
 * (`https://user:pass@host`) are terminated by whitespace. Unquoted secret
 * values contain no internal whitespace; quoted secret values (single- or
 * double-quoted) may contain whitespace within the quotes, but the streaming
 * redactor does not handle those — it relies on `redactText` for complete
 * command strings, so any token preceding the final whitespace in the
 * buffer is complete and safe to redact and emit. The unterminated trailing
 * token is held back until more input (or {@link StreamingRedactor#flush})
 * arrives. Notably `https://user:pass` without a terminating `@host` is not a
 * credential URL at all, so holding it back until whitespace guarantees the
 * `@host` half has arrived before anything is emitted.
 *
 * The held-back tail is bounded. An over-long non-sensitive token is trimmed to
 * its trailing `maxHold` characters. An over-long secret assignment is redacted
 * once and then discarded until its terminating whitespace, so no suffix can
 * escape and memory remains bounded.
 */
export class StreamingRedactor {
    /**
     * @param {{maxHold?: number, knownSecrets?: string[]}} [opts]
     */
    constructor({ maxHold, knownSecrets }?: {
        maxHold?: number;
        knownSecrets?: string[];
    });
    /** @type {string} */
    pending: string;
    /** @type {string} */
    knownPending: string;
    /** @type {string[]} */
    knownSecrets: string[];
    /** @type {number} */
    maxHold: number;
    /** @type {boolean} */
    discardingSecretValue: boolean;
    /**
     * Appends a chunk and returns the redacted text that is safe to emit now.
     *
     * @param {string} chunk
     * @returns {string}
     */
    push(chunk: string): string;
    /**
     * Applies assignment and credential-URL redaction after known values have
     * been removed from the stream.
     *
     * @param {string} chunk
     * @returns {string}
     */
    pushPatternChunk(chunk: string): string;
    /**
     * Emits and clears any buffered tail. At end of stream the final token is
     * complete, so redactText fully masks any secret it contains.
     *
     * @returns {string}
     */
    flush(): string;
    /**
     * Replaces complete known values while retaining only a possible value
     * prefix between chunks.
     *
     * @param {string} chunk
     * @param {boolean} [flush]
     * @returns {string}
     */
    redactKnownChunk(chunk: string, flush?: boolean): string;
}
//# sourceMappingURL=redaction.d.ts.map