/** Replace every occurrence of a credential (raw and base64 forms) with a marker. */
export declare function scrubSecret(text: string, secret: string): string;
/**
 * Copy response headers into a plain object, masking the auth-bearing ones so a returned
 * response never re-exposes a credential or session token. The connector's own api-key header
 * (if any) is masked alongside Authorization and Set-Cookie, and the known secret value is
 * scrubbed from every remaining header value in case the upstream reflects it.
 */
export declare function redactHeaders(headers: Headers, apiKeyHeader?: string, secret?: string): Record<string, string>;
//# sourceMappingURL=redact.d.ts.map