/**
 * Query strings carry secrets far more often than they should: OAuth `code` and
 * `state`, magic-link and reset tokens, signed-URL signatures, `?api_key=`. A log
 * line or a trace span is the wrong place for any of them — both are shipped,
 * retained and read by many more people than the request itself.
 */
/** Placeholder for a masked query value. */
export declare const REDACTED = "[REDACTED]";
/**
 * Keeps the path and the parameter NAMES (useful for debugging) and replaces
 * every query VALUE with {@link REDACTED}. The fragment is dropped. Works on a
 * path (`/a?b=c`) and on an absolute URL (`https://h/a?b=c`) alike, and never
 * decodes anything — whatever follows the first `=` of a pair is masked, however
 * it is encoded; a valueless entry (a bare `?<token>`) and a name that does
 * not look like one are masked as well.
 */
export declare function redactUrl(url: string): string;
/** The path alone — no query, no fragment. */
export declare function urlPath(url: string): string;