/**
 * Credential scrubbing for anything captured from the browser.
 *
 * Everything this project captures — request/response headers, response
 * bodies, console output — routinely contains session cookies, bearer tokens
 * and API keys. All of it is forwarded to an LLM client, so it is scrubbed on
 * the way into the store rather than on the way out.
 */
export declare const REDACTED = "[REDACTED]";
/** Header names whose value is always a credential. Compared case-insensitively. */
export declare const SENSITIVE_HEADERS: readonly string[];
/**
 * Decides whether a base64url run is really a token.
 *
 * Three dot-separated segments is JWT-shaped whatever it contains. With fewer —
 * which is what truncation leaves behind — the header is decoded and checked
 * for the fields only a JWT carries.
 */
export declare function isJwt(candidate: string): boolean;
/** Replaces secret-shaped substrings in a single string. */
export declare function redactSecretsInString(input: string): string;
/**
 * Redacts credential-bearing headers while leaving the rest intact — the
 * non-sensitive headers are usually what makes a network log worth reading.
 */
export declare function redactHeaders(headers: Record<string, string> | undefined | null): Record<string, string>;
export interface RedactOptions {
    /** Set false to pass data through untouched. */
    enabled?: boolean;
}
/**
 * Recursively redacts a captured value: sensitive keys by name, and
 * secret-shaped substrings anywhere in the remaining strings.
 */
export declare function redactValue(value: unknown, options?: RedactOptions): unknown;