/**
 * Copyright (c) 2025 Databricks Contributors
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
import type IClientContext from '../contracts/IClientContext';
import type TelemetryEventEmitter from './TelemetryEventEmitter';
/**
 * Build an HTTPS telemetry URL from a host and a path.
 *
 * Refuses anything beyond a bare `host[:port]` so a compromised or mistyped
 * host cannot redirect the authenticated request to an attacker-controlled
 * endpoint. Defeated historical bypasses include:
 *   - protocol-relative prefix: `//attacker.com`
 *   - zero-width / ASCII whitespace in the host
 *   - userinfo (`user:pass@host`)
 *   - path/query/fragment
 *   - CRLF (header injection on some fetch backends)
 *   - loopback / link-local / RFC1918 / cloud-metadata addresses
 *
 * Returns `null` when the host fails any check; callers drop the batch.
 */
export declare function buildTelemetryUrl(host: string, path: string): string | null;
/**
 * Strips common secret shapes from a free-form error string and caps length.
 * Applied before anything is shipped off-box. Redaction happens before
 * truncation so a long stack cannot bury a secret past the cap; truncation
 * then runs a second pass to catch anything that appeared only in the tail.
 */
export declare function redactSensitive(value: string | undefined, maxLen?: number): string;
/**
 * Normalises any `HeadersInit` shape (`Headers`, `[string,string][]`, or
 * `Record<string, string>`) into a plain string dictionary. Non-string
 * values are dropped. Shared by the exporter and FeatureFlagCache so there
 * is one source of truth for auth-header handling.
 */
export declare function normalizeHeaders(raw: unknown): Record<string, string>;
/**
 * Case-insensitive check for a non-empty `Authorization` header.
 */
export declare function hasAuthorization(headers: Record<string, string>): boolean;
/**
 * Returns a safe `process_name` value: the basename of the first whitespace-
 * delimited token, with trailing whitespace trimmed. This defeats both the
 * absolute-path PII leak (`/home/<user>/app.js`) and the argv-leak shape
 * (`node --db-password=X app.js`) that some producers pass in.
 */
export declare function sanitizeProcessName(name: string | undefined): string;
/**
 * Run a telemetry emit at a call site, swallowing all exceptions and logging
 * at debug level. Replaces the copy-pasted try/catch + getTelemetryEmitter?.()
 * scaffold at every emit site. Telemetry must never break the driver.
 *
 * The type-only imports keep this helper free of runtime cycles:
 * `IClientContext` imports `TelemetryEventEmitter` only as a type, and this
 * helper does the same, so there's no value-level cycle. A typo like
 * `emitter.emiitConnectionOpen(...)` is now a TS compile error instead of a
 * swallowed runtime exception.
 */
export declare function safeEmit(context: IClientContext, fn: (emitter: TelemetryEventEmitter) => void): void;