/**
 * SecretProxyManager — bridges EnvSecretStore with the masking engine
 * for the fetch-proxy handler.
 *
 * On init: loads all secrets, generates session-scoped masked values,
 * and builds lookup tables for fast replacement.
 *
 * As of Task 1.4, this is a thin wrapper around SecretsPipeline from @slicc/shared-ts.
 */
import { SecretsPipeline, SessionSecretStore } from '../_shared/index.js';
import type { EnvSecretStore } from './env-secret-store.js';
import type { OauthSecretStore } from './oauth-secret-store.js';
export declare class SecretProxyManager {
    private readonly pipeline;
    private readonly _sessionId;
    private _envStore?;
    private _oauthStore?;
    /** In-memory session secrets, layered into the pipeline; never persisted. */
    readonly sessionStore: SessionSecretStore;
    constructor(store?: EnvSecretStore, sessionId?: string, oauthStore?: OauthSecretStore, sessionStore?: SessionSecretStore);
    private buildSource;
    setOauthStore(store: OauthSecretStore): void;
    get sessionId(): string;
    /**
     * Underlying pipeline. Exposed for CDP proxy unmasking, which needs to
     * call `unmaskCdpFrame(frame, hostname, pipeline)` (whole-token, gated
     * on the target tab's current hostname). Do not use for new fetch-proxy
     * paths — prefer the typed `unmask*` methods above.
     */
    get rawPipeline(): SecretsPipeline;
    reload(): Promise<void>;
    hasSecrets(): boolean;
    getMaskedEntries(): Array<{
        name: string;
        maskedValue: string;
        domains: string[];
    }>;
    unmask(text: string, targetHostname: string): {
        text: string;
        forbidden?: {
            secretName: string;
            hostname: string;
        };
    };
    unmaskBody(text: string, targetHostname: string): {
        text: string;
    };
    unmaskHeaders(headers: Record<string, string>, targetHostname: string): {
        forbidden?: {
            secretName: string;
            hostname: string;
        };
    };
    signHmac(spec: string, body: Uint8Array, targetHostname: string): Promise<{
        headerName?: string;
        signatureHex?: string;
        timestampHeaderName?: string;
        timestampValue?: string;
        forbidden?: {
            secretName: string;
            hostname: string;
        };
    }>;
    extractAndUnmaskUrlCredentials(rawUrl: string): import("../_shared/index.js").ExtractedUrlCreds;
    scrubResponse(text: string): string;
    scrubHeaders(headers: Headers): Record<string, string>;
}