import type { CapturedRequest, OprfMode, ReclaimProvider, ResponseMatch, ResponseRedaction, SecretParamRef } from './schema.ts';
/** OPRF mode to apply when the caller passed none: the anti-leak floor —
 *  force-hash a value whose SHAPE is unambiguous PII, but ONLY when it's
 *  OPRF-hashable AND within the 62-byte MPC-circuit cap (UTF-8). Undefined =
 *  leave plaintext (a longer value can't be OPRF'd; contextual PII + the proven
 *  identity are the model's/plaintext call). */
export declare function defaultSensitiveHash(value: string): OprfMode | undefined;
/** One value to extract from the request: the captured `value`, a `name` (its
 *  param / capture-group), and an optional per-target OPRF `hash`. */
export interface DraftTarget {
    value: string;
    name: string;
    hash?: OprfMode;
}
/** The realized extraction for one target — its value paired with the
 *  redaction that reveals it (absent when matched literally). Lets a consumer
 *  validate each value against its own selector (for example, the cloud
 *  replay). */
export interface Extraction {
    name: string;
    value: string;
    redaction?: ResponseRedaction;
}
export interface DraftResult {
    provider: ReclaimProvider;
    secretRefs: SecretParamRef[];
    /** One entry per target, in `responseMatches` order. */
    extractions: Extraction[];
}
/** Reject a draft that bakes a captured per-user value as a LITERAL into a
 *  match or redaction — either a neighbouring target's value or a target's own
 *  value left un-templated. The matcher builds each target's window
 *  independently and drops the per-user WORDS it can see, but it cannot know a
 *  neighbouring value is itself user-specific (for example, a name sharing a
 *  text node with an id — a `<b>{{id}}</b>` sitting beside a
 *  `<td>{{name}}</td>`). Cross-checking every value against every match here
 *  catches
 *  that: a portable provider contains NO captured value as a literal — each
 *  appears only as its `{{param}}`. Throwing discards the draft so the agent
 *  re-captures or re-proposes rather than shipping a provider pinned to this
 *  one user. */
export declare function assertPortableMatches(matches: ResponseMatch[], redactions: ResponseRedaction[], targets: DraftTarget[]): void;
/** Reject a draft that OPRF-hashes a target whose value ALSO appears in the
 *  request URL. The whole point of `hash` is that the attestor never sees
 *  the value in cleartext — but URL `paramValues` are always signed into the
 *  attestor's context in the clear (attestor-core: "those in URL... will be
 *  put into context and signed"), so a value that's both hashed in the
 *  response AND present in the URL is visible there anyway. This isn't a
 *  privacy nuance the author can weigh (unlike {@link assertPortableMatches}
 *  bare-literal cases) — it doesn't verify. Throwing here, at draft time,
 *  surfaces that immediately instead of a confusing later proof failure. */
export declare function assertNoOprfUrlConflict(url: string, targets: DraftTarget[], effectiveHashes: (OprfMode | undefined)[]): void;
/** Reject a draft whose URL bakes in a secret header/cookie's value beyond
 *  what write-redaction can actually hide there. A secret value used in the
 *  URL is NOT an automatic leak — write-redaction (`key-update`/`zk`) can
 *  redact it from the attestor's view up to {@link secretUrlCharBudget}
 *  characters, summed across every secret value that appears in that URL
 *  (not per-value). Below the budget the header buys real privacy; at or
 *  over it, the value is effectively visible regardless of hiding the
 *  header (same class of problem as {@link assertNoOprfUrlConflict} for
 *  OPRF-hashed targets, which has no such budget at all). */
export declare function assertNoSecretUrlConflict(url: string, secrets: Record<string, string>, writeRedactionMode?: ReclaimProvider['writeRedactionMode']): void;
export declare function draftProvider(req: CapturedRequest, targets: DraftTarget[], name: string, hash?: OprfMode, opts?: {
    shortenNames?: boolean;
}): DraftResult;