/**
 * Credential redaction for logs and audit events.
 *
 * Authentication code logs request context (auth outcomes, JWT failures,
 * resolver throws) and the audit trail records who called what. None of that
 * may ever carry a live credential: an `Authorization: Bearer <token>` value,
 * an `X-API-Key`, or a `Cookie`/`Set-Cookie` session token leaking into a log
 * line is a credential disclosure. These helpers mask such values *before* they
 * reach `console.*` or an audit sink.
 *
 * The redaction is one-way and irreversible. A masked value keeps just enough
 * shape to correlate two log lines about the same credential (a short stable
 * fingerprint) without revealing the secret itself.
 *
 * @module server/authentication/redaction
 */
/**
 * Mask a credential value so it can appear in a log or audit record without
 * disclosing the secret. The result reveals only the length bucket and a short
 * non-reversible fingerprint, which is enough to tell whether two log lines
 * concern the same credential without exposing it.
 *
 * The fingerprint is derived from a non-cryptographic hash of the value. It is
 * deliberately *not* the raw prefix of the token — revealing even a prefix of a
 * high-entropy API key narrows a brute-force search. Equal inputs produce equal
 * fingerprints; differing inputs almost always differ.
 *
 * @example
 * ```ts
 * import { redactCredential } from '@lostgradient/weft/server';
 *
 * const masked = redactCredential('weft_key_super_secret_value');
 * console.log(masked.startsWith('<redacted:')); // true
 * console.log(masked.includes('secret')); // false
 * ```
 */
export declare function redactCredential(value: string | null | undefined): string;
/**
 * Produce a plain object snapshot of a request's headers with every sensitive
 * value masked via {@link redactCredential}. Use this when attaching request
 * headers to a log line or audit record — it guarantees no credential header
 * passes through verbatim.
 *
 * Header names are lower-cased (the `Headers` iterator already lower-cases
 * them) so the result is stable regardless of the casing the client sent.
 *
 * @example
 * ```ts
 * import { redactHeaders } from '@lostgradient/weft/server';
 *
 * const request = new Request('http://localhost/v1/workflows', {
 *   headers: { Authorization: 'Bearer secret-token', 'X-Trace-Id': 'abc' },
 * });
 * const safe = redactHeaders(request.headers);
 * console.log(safe['x-trace-id']); // 'abc'
 * console.log(safe['authorization']?.startsWith('<redacted:')); // true
 * ```
 */
export declare function redactHeaders(headers: Headers): Record<string, string>;
/**
 * Whether a header name is treated as credential-bearing and therefore masked
 * by {@link redactHeaders}. Comparison is case-insensitive.
 *
 * @example
 * ```ts
 * import { isSensitiveHeader } from '@lostgradient/weft/server';
 *
 * console.log(isSensitiveHeader('Authorization')); // true
 * console.log(isSensitiveHeader('X-Trace-Id')); // false
 * ```
 */
export declare function isSensitiveHeader(name: string): boolean;