/**
 * How much of a stored secret the settings pane is allowed to show.
 *
 * The user has to be able to *confirm* what they configured — a pane that only
 * ever says 「已配置」 cannot tell a correct appId from a typo — but a browser
 * tab (or a screenshot of one) must never hold a usable credential. The two are
 * reconciled here: the host masks the value **before it crosses the wire**, so
 * what the pane receives is already unusable, and `maskSecret` is the only
 * place that decides how much survives.
 *
 * Deliberately pure and dependency-free: the host (`settings-service`) masks
 * with it and the client bundle imports the same compiled module for the input
 * `type`, so the two can never drift into disagreeing about which keys are
 * confidential.
 *
 * @module dsh-connect/settings/secret-disclosure
 */
/**
 * - `full` — shown verbatim. For identifiers, not authenticators.
 * - `mask` — head and tail survive, the middle does not.
 * - `url` — a URL whose *query* carries the token, so only that part is masked.
 */
export type Disclosure = "full" | "mask" | "url";
/**
 * Per-config-key policy, keyed by the channel config key (`CREDENTIAL`-style
 * keys are unique across channels: no channel has two fields that share a name
 * but want different treatment).
 *
 * `appId` / `clientId` are `full` on purpose. They are **identifiers**: they
 * appear in the URL or body of every outbound API call, are readable in the
 * vendor's own console, and grant nothing without the paired secret. Masking
 * them would cost the user the one thing this pane is for — checking that the
 * id they pasted is the one they meant — and buy no secrecy at all.
 */
export declare const SECRET_DISCLOSURE: Record<string, Disclosure>;
/** Policy for a config key; unknown keys are treated as confidential. */
export declare function disclosureOf(configKey: string): Disclosure;
/** True when the pane should render this key as a password input. */
export declare function isMaskedSecret(configKey: string): boolean;
/**
 * The display preview for one stored secret. Never returns the input: for
 * `mask` and `url` the returned string is lossy by construction, so a caller
 * that echoes it to a browser cannot leak a usable credential.
 *
 * Surrounding whitespace is trimmed first — a pasted value commonly carries a
 * trailing newline, and the mask should describe the stored value, not the
 * paste.
 */
export declare function maskSecret(configKey: string, value: string): string;
//# sourceMappingURL=secret-disclosure.d.ts.map