/**
 * Secure Memory Utilities for NotebookLM MCP Server
 *
 * Provides best-effort handling of sensitive data in memory:
 * - Zero-fill backing Buffers after use
 * - Secure string class that wipes its backing Buffer
 * - Time-bounded credential handling
 *
 * Why this matters — and its limits:
 * - REDUCES the exposure window for credentials in memory; it does not
 *   eliminate it.
 * - This is mitigation, NOT prevention, of memory-dump or cold-boot attacks.
 *   We cannot guarantee secrets are gone from RAM after wipe().
 * - V8 caveat: JavaScript strings are immutable. The input string passed in,
 *   and every value produced by toString() / getValue(), are independent V8
 *   string copies on the heap that this code CANNOT wipe and that persist
 *   until garbage collection (and possibly beyond, in freed-but-unzeroed
 *   memory). Only the internal Buffer is zeroed by wipe().
 *
 * Added by Pantheon Security for hardened fork.
 */
/// <reference types="node" resolution-mode="require"/>
/// <reference types="node" resolution-mode="require"/>
/**
 * Securely zero-fill a Buffer
 * Uses crypto.randomFill first to prevent compiler optimization removal
 */
export declare function zeroBuffer(buffer: Buffer): void;
/**
 * Securely zero-fill a Uint8Array
 */
export declare function zeroUint8Array(arr: Uint8Array): void;
/**
 * Create a secure string that can be wiped
 * Note: JavaScript strings are immutable, so we use a Buffer internally
 * Caveat: source string contents may remain in V8 heap until garbage collection.
 */
export declare class SecureString {
    private buffer;
    private wiped;
    constructor(value: string);
    /**
     * Get the string value.
     * Note: returns a new immutable V8 string copy that cannot be wiped and
     * persists until garbage collection. Avoid retaining the result longer
     * than necessary.
     */
    toString(): string;
    /**
     * Get the underlying buffer (for crypto operations)
     */
    toBuffer(): Buffer;
    /**
     * Get length without exposing content
     */
    get length(): number;
    /**
     * Wipe the backing Buffer (best effort).
     * Only zeroes the internal Buffer; any string copies previously returned
     * by toString() / the constructor input remain in the V8 heap until GC.
     */
    wipe(): void;
    /**
     * Check if already wiped
     */
    isWiped(): boolean;
}
/**
 * Secure credential holder with automatic wiping
 */
export declare class SecureCredential {
    private value;
    private createdAt;
    private maxAgeMs;
    private autoWipeTimer?;
    constructor(credential: string, maxAgeMs?: number);
    /**
     * Get the credential value.
     * Note: returns an immutable V8 string copy that cannot be wiped and
     * persists until garbage collection.
     */
    getValue(): string;
    /**
     * Check if credential has expired
     */
    isExpired(): boolean;
    /**
     * Get time remaining before auto-wipe (ms)
     */
    getTimeRemaining(): number;
    /**
     * Securely wipe the credential
     */
    wipe(): void;
    /**
     * Check if already wiped
     */
    isWiped(): boolean;
}
/**
 * Execute a function with a secure credential, auto-wiping after use
 */
export declare function withSecureCredential<T>(credential: string, fn: (cred: SecureCredential) => Promise<T>): Promise<T>;
/**
 * Secure comparison to prevent timing attacks.
 *
 * Both operands are hashed (SHA-256) into a fixed-length digest before the
 * constant-time comparison. This:
 *  - makes timingSafeEqual always run on the same number of bytes regardless of
 *    input length, leaking nothing about the actual lengths, and
 *  - compares the FULL content of each operand (L5): the previous version
 *    truncated both inputs to 64 bytes, so two distinct values sharing their
 *    first 64 bytes would compare equal. Hashing covers the entire input.
 *
 * The trailing length check is kept as defence-in-depth; SHA-256 already
 * distinguishes different-length inputs.
 */
export declare function secureCompare(a: string | Buffer, b: string | Buffer): boolean;
/**
 * Generate a secure random string
 */
export declare function secureRandomString(length: number, encoding?: BufferEncoding): string;
/**
 * Mask sensitive data for logging (doesn't expose real length)
 */
export declare function maskSensitive(value: string, showChars?: number): string;