/**
 * Capability-bearing URL projection.
 *
 * Incident 716957 (todos b03cc058): a stored destination that is itself a
 * signed capability URL (an S3 presigned read URL, GCS, or CloudFront signed
 * URL) was emitted verbatim by the CLI into a probe file and reproduced in a
 * session transcript, granting bearer read access until expiry. `secrets scan`
 * does not cover this class, so consumer-side containment is the interim
 * behaviour required by the capability-bearing-output doctrine.
 *
 * Output therefore projects such a URL to its plain unsigned reference — the
 * scheme/host/path with every capability query parameter stripped. A consumer
 * resolving the projected reference goes through the normal unsigned path and
 * never receives a bearer credential from a transcript.
 */
import type { Link } from "../types.js";
/** True when `url` is an http(s) URL whose query carries a signed-capability parameter. */
export declare function hasCapabilityQuery(url: string): boolean;
/**
 * Project `url` to its plain unsigned reference: the same scheme/host/path
 * with every capability query parameter stripped and non-capability parameters
 * preserved. Non-capability or malformed values are returned unchanged.
 */
export declare function projectDestinationUrl(url: string): string;
/** Project a Link record's destination_url (identity when already plain). */
export declare function projectLink(link: Link): Link;
/**
 * Project a CLI payload for output: a Link, an array of Links, or a LinkStats
 * record get their destination_url projected; every other payload passes
 * through untouched (same object reference).
 */
export declare function projectForOutput(data: unknown): unknown;