import { OpenClawSecretBroker } from "@secr/openclaw";
import { McpGateway } from "@secr/mcp/gateway";
import type { PluginConfig } from "./types.js";
/**
 * Lazily-initialised plugin singleton. The plugin loads at OpenClaw startup
 * but we defer the actual broker construction (which reads SECR_AGENT_TOKEN)
 * until first use so plugin discovery / setup-only registration modes don't
 * fail when the token isn't yet present.
 */
export declare class PluginState {
    private readonly config;
    private broker;
    private gateway;
    private gatewayInitialized;
    private brokerInitPromise;
    private secretValuesCache;
    private secretValuesCachedAt;
    private static readonly SECRET_CACHE_TTL_MS;
    private static readonly MIN_REDACT_VALUE_LEN;
    constructor(config: PluginConfig);
    /**
     * Returns the set of secret VALUES the agent is allowed to read, suitable
     * for content-filter redaction. Caches for 5 minutes. Excludes values
     * shorter than 8 chars (too many false positives).
     *
     * Never logs values. Never returns the cache externally — callers receive
     * a fresh Set each call so they can iterate without persisting refs.
     */
    getRedactionValues(): Promise<Set<string>>;
    getBroker(): Promise<OpenClawSecretBroker>;
    getGateway(): Promise<McpGateway>;
}
//# sourceMappingURL=state.d.ts.map