import type { ReclaimProvider } from './schema.ts';
export declare function classifyHeader(name: string): boolean;
/** Drop {@link STRIP_REQUEST_HEADERS} and HTTP/2 pseudo-headers. Call this on
 *  the RAW captured headers before {@link splitSecrets} — both the draft-time
 *  authoring flow and the live per-user verification capture need it, so
 *  neither ends up sending a duplicate `Host` or an invalid `:authority` to
 *  the attestor via either the public or the secret channel. */
export declare function stripTransportHeaders(headers: Record<string, string>): Record<string, string>;
export declare function splitSecrets(headers: Record<string, string>): {
    secrets: Record<string, string>;
    publics: Record<string, string>;
};
/** Total characters write-redaction can hide from the attestor, summed
 *  ACROSS EVERY secret-classified value used in the URL — not a per-value
 *  cap. Default mode (`'key-update'`, also what an unset field resolves to)
 *  caps at 2; `'zk'` at 12. At or under the budget the overlap is genuinely
 *  hidden; over it, the value (or the combination of values) is effectively
 *  still visible to the attestor regardless of secret-marking. */
export declare function secretUrlCharBudget(writeRedactionMode: ReclaimProvider['writeRedactionMode']): number;
/** A `paramValues`/context key is secret iff its name contains `SECRET`
 *  (case-insensitive) — for example, `SECRET_apiKey`, `context.SECRET_apiKey`.
 *  Same naming-convention classifier reclaim-inapp-sdk and reclaim-portal use
 *  for their `witnessParams`/`paramValues` maps (no separate boolean flag). */
export declare function classifyParamName(name: string): boolean;
/** Split a `paramValues` map (bare `{{name}}` / `{{context.<name>}}` entries)
 *  into public (→ `params.paramValues`, revealed to the attestor) and secret
 *  (→ `secretParams.paramValues`) by {@link classifyParamName}. A secret
 *  value used in the URL is still hidden — up to {@link secretUrlCharBudget}
 *  characters, summed across every such value in that URL. */
export declare function splitSecretParamValues(paramValues: Record<string, string>): {
    secrets: Record<string, string>;
    publics: Record<string, string>;
};
/** Reject a proof attempt whose URL/geoLocation templates SECRET-named
 *  context param(s) whose ACTUAL values (now known — the consumer supplied
 *  them at session-create) exceed the write-redaction budget once summed.
 *  Structural placement (which params end up in the URL) is knowable at
 *  publish time and isn't rejected there — only the real values decide
 *  whether it fits, and those only exist once a verification session is
 *  underway. Checks the placeholder TOKEN (`{{<key>}}`), not a value search —
 *  the URL/geoLocation explicitly reference the param by name. */
export declare function assertSecretParamValuesFitUrlBudget(url: string, geoLocation: string | undefined, secretParamValues: Record<string, string>, writeRedactionMode: ReclaimProvider['writeRedactionMode']): void;