import type { CaptureSession } from '../cdp/capture-engine.ts';
import type { Extraction } from '../provider/draft.ts';
import type { ReclaimProvider, SecretParamRef } from '../provider/schema.ts';
/** Secret request params (cookie/auth headers), materialized only for the
 *  replay/prove call — never surfaced in tool output. */
export interface SecretParams {
    headers: Record<string, string>;
}
/** A drafted recipe held server-side so the model only handles an opaque
 *  `draftId` — the provider is secret-free but the captured secrets never enter
 *  the transcript. Shared by propose → replay → run_proof. */
export interface Draft {
    provider: ReclaimProvider;
    secretRefs: SecretParamRef[];
    /** Real secret header values (cookie/auth) for replay/prove — never returned
     *  to the model. */
    secrets: Record<string, string>;
    /** The captured request this draft was proposed from. */
    requestId: string;
    /** One entry per extracted value (value + its redaction), so replay can
     *  validate each against its own selector. */
    extractions: Extraction[];
}
/** Per-session draft store: `propose` puts, `replay`/`run_proof` get by id. */
export interface DraftStore {
    put(draft: Draft): string;
    get(id: string): Draft | undefined;
}
export declare function makeDraftStore(): DraftStore;
/** Options for a proof run. `ownerAddress` selects the local signing credential
 *  and `attestorUrl` overrides the attestor endpoint (both MCP-only); the
 *  remote TEE backend ignores them (it signs in-enclave, own attestor). */
export interface ProveOptions {
    ownerAddress?: string;
    attestorUrl?: string;
}
/**
 * Everything the shared authoring tools need from one live session. Browser ops
 * go through `sendCdp` (+ `waitForEvent` for load-style waits); capture reads
 * use `capture`; proof/replay are whole operations because they genuinely
 * differ (local attestor + live re-fetch vs remote TEE) — each backend shapes
 * its own result, passed straight through as the tool's output.
 */
export interface AuthoringBackend {
    /** Ask Chrome to reject page evaluation when side effects cannot be ruled
     * out. Cloud authoring enables this; local MCP keeps its existing
     * behavior. */
    readonly readOnlyPageEval?: boolean;
    /** Send a raw CDP command scoped to this session's page. */
    sendCdp(method: string, params?: Record<string, unknown>): Promise<unknown>;
    /** Resolve once `method` (a CDP event) fires on this session's page, or
     *  after `timeoutMs`. Used for `Page.loadEventFired`-style waits. */
    waitForEvent(method: string, timeoutMs: number): Promise<'fired' | 'timeout'>;
    /** This session's captured requests (the shared capture engine). */
    readonly capture: CaptureSession;
    /** This session's drafts (propose → replay/run_proof). */
    readonly drafts: DraftStore;
    /** Prove a drafted recipe. Local: attestor SDK (rich claim view). Remote: TEE
     * `/reclaim/prove` (lean, secret-free summary). Returns the environment's
     * display shape. A backend may record the proven recipe internally (for
     * example, the cloud publish step) — that side effect is the backend's, not
     * ours. */
    prove(draft: Draft, opts?: ProveOptions): Promise<unknown>;
    /**
     * Validate/replay a drafted recipe before proving. Both local and remote
     * backends re-issue the request FROM INSIDE the live attached page (a
     * `fetch` run over CDP), never a detached out-of-band call, so replay
     * always reflects the real browser session. With `withoutSecrets` it is
     * the AUTH-BOUND check: re-issue anonymously (`credentials: 'omit'`, no
     * secret headers) and report whether the values are STILL extractable —
     * that is, the endpoint is public. Without it, validate extraction for the
     * authenticated request. The shape is environment-specific and passed
     * straight through as the tool's result.
     */
    replay(draft: Draft, opts?: {
        withoutSecrets?: boolean;
    }): Promise<unknown>;
}