/** Every placeholder starts with this, whichever side minted it. */
export declare const CREDENTIAL_PLACEHOLDER_PREFIX = "lobu_secret_";
/** `true` when the text carries something shaped like a placeholder, whoever minted it. */
export declare function containsCredentialPlaceholder(text: string): boolean;
/** One placeholder the vault resolved into a request header. */
export interface CredentialSpend {
    placeholder: string;
    /** Lower-cased name of the header the real value went into. */
    header: string;
}
export interface SwapHeadersOptions {
    /**
     * Whether a plaintext `http:` destination may carry the credential. The
     * isolate lane grants this only to the run's own machine: a loopback or
     * reserved literal (or `localhost`) that the allowlist names exactly, which
     * is how a self-hosted install reaches a local service and how a fixture
     * reaches its loopback server. Everywhere else the transport's HTTPS rule
     * applies.
     */
    plaintextAllowed: boolean;
}
export declare class CredentialVault {
    private readonly values;
    /** Hide `value` behind a fresh placeholder only this vault can resolve. */
    mint(value: string): string;
    /** How many secrets the vault holds. */
    get size(): number;
    /**
     * Replace every placeholder in `headers` with its real value, in place, and
     * report which header each went into. Refuses, leaving the headers as they
     * were: a placeholder in the URL (a credential there lands in access logs,
     * referrers and error bodies upstream), one this vault did not mint (the
     * guest fabricated it, or replayed one from an earlier run), and a plaintext
     * destination unless `plaintextAllowed`. Header values that carry no
     * placeholder are never touched, so an unauthenticated `http:` request is
     * unaffected by the HTTPS rule.
     */
    swapHeaders(headers: Headers, url: URL, options: SwapHeadersOptions): CredentialSpend[];
    /** Forget every value; the placeholders stop resolving. */
    clear(): void;
}
//# sourceMappingURL=credentials.d.ts.map