/**
 * Secret masking engine — HMAC-SHA256 based, format-preserving.
 *
 * Used on both agent side (env population, output scrubbing) and
 * server side (fetch proxy response scrubbing).
 */
export declare function hmacSha256Hex(key: string, message: Uint8Array): Promise<string>;
/**
 * Produce a deterministic, format-preserving masked value.
 *
 * `masked = prefix + hex(HMAC-SHA256(sessionId+secretName, realValue))`
 * truncated/repeated to match `realValue.length - prefix.length`.
 */
export declare function mask(sessionId: string, secretName: string, realValue: string): Promise<string>;
export interface SecretPair {
    realValue: string;
    maskedValue: string;
}
/**
 * Minimum length a secret value must have to be registered as a masking
 * pattern. Values shorter than this are skipped: a 1-byte "value" would
 * collide with arbitrary bytes on every outbound request and falsely
 * trigger the cross-domain forbidden path (the `INTTEST_BLOCKED` Adobe
 * blocker scenario).
 *
 * Rationale on the cutoff: `secret peek` already reveals the first 4 +
 * last 4 characters of a value, so any value of 8 chars or fewer is
 * already fully disclosed by peek — leaving it unmasked loses no
 * secrecy. The constant is exported so callers (and the Swift twin)
 * stay in sync; tune both sides together.
 */
export declare const MIN_MASKABLE_SECRET_LENGTH = 9;
/**
 * Build a reusable scrubber function that replaces every occurrence
 * of any `realValue` with its `maskedValue`.
 *
 * For a small number of secrets a simple sequential replace is fine.
 * Secrets are sorted longest-first to avoid partial-match issues.
 *
 * Values shorter than `MIN_MASKABLE_SECRET_LENGTH` are silently dropped
 * here as a defensive guard. The chokepoint that actually surfaces the
 * skip to operators is `SecretsPipeline.reload()` (which has the secret
 * name available and emits a single warning per skipped entry).
 */
export declare function buildScrubber(secrets: SecretPair[]): (text: string) => string;
/**
 * Domain glob matching.
 *
 * - `api.github.com` matches exactly `api.github.com`
 * - `*.github.com`   matches `api.github.com`, `uploads.github.com`,
 *                     but NOT `github.com` itself
 */
export declare function domainMatches(pattern: string, hostname: string): boolean;
/**
 * Check if hostname is allowed by any of the domain patterns.
 */
export declare function isAllowedDomain(patterns: string[], hostname: string): boolean;
/**
 * Compatibility alias for node-server's historical name + arg order.
 * Prefer `isAllowedDomain(patterns, hostname)` in new code.
 */
export declare function matchesDomains(hostname: string, patterns: string[]): boolean;
//# sourceMappingURL=secret-masking.d.ts.map