export interface SecretEntry {
    value: string;
    /** Allowed hostnames. Empty array = any domain (strongly discouraged). */
    domains: string[];
    createdAt: string;
    updatedAt: string;
}
export interface SecretsFile {
    version: 1;
    secrets: Record<string, SecretEntry>;
}
export interface SecretProvider {
    getSecret(key: string): Promise<string | undefined>;
}
export interface SecretListEntry {
    key: string;
    domains: string[];
    updatedAt: string;
}
export declare const GLOBAL_SECRETS_PATH: string;
export declare const PROJECT_SECRETS_DIRNAME = ".weavetab";
export declare const PROJECT_SECRETS_FILENAME = "secrets.json";
/** Absolute path of the project-scoped secrets file for a directory (default: cwd). */
export declare function getProjectSecretsPath(cwd?: string): string;
/** Creates an empty project-scoped secrets file (chmod 600). Returns its path. */
export declare function initProjectSecrets(cwd?: string): string;
declare class JsonSecretStoreImpl implements SecretProvider {
    /**
     * Resolve a secret value by key.
     * Returns undefined if the key doesn't exist.
     * Does NOT check domain — use checkDomain() for that before calling this.
     */
    getSecret(key: string): Promise<string | undefined>;
    /**
     * Check whether the given hostname is allowed for this key.
     * Returns true if:
     *   - The key doesn't exist (will fail at getSecret time anyway)
     *   - The key's domains list is empty (wildcard — any domain)
     *   - The hostname matches one of the allowed domains (exact or suffix match)
     */
    checkDomain(key: string, hostname: string): boolean;
    /**
     * Get the allowed domains list for a key (for error messages).
     * Never returns the value.
     */
    getDomains(key: string): string[] | null;
    /**
     * Store a secret. Value must be passed in-process — never as a CLI arg.
     * domains: list of allowed hostnames. Empty = any domain (not recommended).
     */
    setSecret(key: string, value: string, domains: string[]): Promise<void>;
    /**
     * List all secrets — returns key names, domains, and timestamps ONLY.
     * Never returns values.
     */
    listSecrets(): Promise<SecretListEntry[]>;
    /**
     * Remove a secret by key. Returns true if the key existed and was removed.
     */
    removeSecret(key: string): Promise<boolean>;
    /** Returns the active secrets file path for display purposes. */
    getSecretsFilePath(): string;
}
export declare const secretStore: JsonSecretStoreImpl;
/** @deprecated Use secretStore instead. */
export declare class EnvSecretProvider implements SecretProvider {
    getSecret(key: string): Promise<string | undefined>;
}
declare class SessionSecretTrackerImpl {
    /** Maps sessionId (CDP targetId) → Set of backendNodeIds marked as secret. */
    private trackedNodes;
    /** Maps sessionId (CDP targetId) → Set of plaintext secret strings injected. */
    private sessionSecrets;
    markNodeAsSecret(sessionId: string, backendNodeId: number): void;
    isNodeSecret(sessionId: string, backendNodeId: number): boolean;
    registerSecretValue(sessionId: string, value: string): void;
    redact(sessionId: string, text: string): string;
    redactAll(text: string): string;
    clearSession(sessionId: string): void;
}
export declare const SessionSecretTracker: SessionSecretTrackerImpl;
export {};