/**
 * redactUrl — strip credentials from URLs before they reach any log sink.
 *
 * The 2026-05-27 incident: `instar join` formatted a clone URL containing a
 * live GitHub token (`https://x-access-token:gho_…@github.com/…`) into an
 * error message that was printed to stdout. Node's own fetch/URL errors echo
 * the full credentialed URL in `err.message`, so even catching the error and
 * logging `err.message` leaks the secret.
 *
 * This module is the single redaction funnel. Anywhere a URL (or a string that
 * may embed one) is about to be logged, route it through `redactUrl` /
 * `redactUrlsInText` first. The companion lint rule
 * (`scripts/lint-no-direct-url-log.js`) bans logging a raw `user:pass@host`
 * URL outside this module + its tests.
 *
 * Design notes:
 * - Fail-OPEN to the SAFE side: on any parse failure we still attempt a
 *   regex-based scrub rather than returning the raw input, because the whole
 *   point is "never leak a credential." We never throw.
 * - Idempotent: redacting an already-redacted string is a no-op.
 * - Preserves everything except the userinfo segment, so logs stay useful
 *   (host, path, query — minus any token that lived in the query is NOT
 *   handled here; query-embedded secrets are a separate concern, see
 *   `scrubKnownTokenPatterns`).
 */
/**
 * Redact the userinfo (user:password@) segment of a single URL string.
 * Returns the URL with `***:***@` (or `***@`) in place of any credentials.
 * Non-URL input is returned with token-pattern scrubbing applied.
 */
export declare function redactUrl(input: string | URL): string;
/**
 * Redact every URL embedded in a larger block of text (e.g. an error message
 * that interpolated a URL). Use this when logging `err.message` or any string
 * that might contain a credentialed URL somewhere inside it.
 */
export declare function redactUrlsInText(text: string): string;
//# sourceMappingURL=redactUrl.d.ts.map