/**
 * OAuth secret redactor — single choke point.
 *
 * Every value reaching any sink passes through these helpers first.
 * Adding a new sensitive key here is the only place it has to change.
 *
 * DEFERRED: per-event syscall throttling; fsync / file-size cap on file sink.
 */
/** Redact sensitive query-param values inside any string. Idempotent. */
export declare function redactString(s: string): string;
/** Redact a parsed URL by name; returns redacted href or original on parse error. */
export declare function redactUrl(u: string): string;
/**
 * Shallow-redact a plain object. Returns a new object; original is not mutated.
 * Arrays are recursed so token arrays (e.g. `{tokens:[{access_token:'AT'}]}`)
 * do not bypass redaction.
 */
export declare function redactJsonShallow(input: Record<string, unknown>): Record<string, unknown>;
/** Redact an Authorization header value. */
export declare function redactBearer(header: string): string;
export declare const REDACTED_PLACEHOLDER = "***REDACTED***";
//# sourceMappingURL=redactor.d.ts.map