import type { AgentMessage } from "@oh-my-pi/pi-agent-core";
import type { AssistantMessage, Context, Message } from "@oh-my-pi/pi-ai";
import type { SessionContext } from "../session/session-context.js";
export interface SecretEntry {
    type: "plain" | "regex";
    content: string;
    mode?: "obfuscate" | "replace";
    replacement?: string;
    flags?: string;
}
export type JsonValue = string | number | boolean | null | JsonValue[] | {
    [key: string]: JsonValue | undefined;
};
export type JsonRecord = {
    [key: string]: JsonValue | undefined;
};
export declare class SecretObfuscator {
    #private;
    constructor(entries: SecretEntry[]);
    hasSecrets(): boolean;
    /** Obfuscate all secrets in text. Bidirectional placeholders for obfuscate mode, one-way for replace. */
    obfuscate(text: string): string;
    /** Deobfuscate obfuscate-mode placeholders back to original secrets. Replace-mode is NOT reversed. */
    deobfuscate(text: string): string;
}
/**
 * Restore secret placeholders for local display. Only message kinds the model
 * itself authored from obfuscated context carry placeholders — assistant
 * content and the LLM-written branch/compaction summaries. User, developer, and
 * tool-result messages are persisted with their literal text, so a literal
 * `#ABCD#` the operator typed must survive untouched; those roles are never
 * walked.
 */
export declare function deobfuscateSessionContext(sessionContext: SessionContext, obfuscator: SecretObfuscator | undefined): SessionContext;
export declare function deobfuscateAgentMessages(obfuscator: SecretObfuscator, messages: AgentMessage[]): AgentMessage[];
/**
 * Restore placeholders in assistant content: visible text and tool-call
 * arguments/intent/rawBlock. Thinking and signatures are opaque
 * provider-replay/hidden-reasoning data and pass through byte-identical.
 */
export declare function deobfuscateAssistantContent(obfuscator: SecretObfuscator, content: AssistantMessage["content"]): AssistantMessage["content"];
/**
 * Restore placeholders inside a tool call's arguments. Arguments are arbitrary
 * model-authored JSON, so tool-call arguments are the ONLY place a recursive
 * JSON walk runs.
 */
export declare function deobfuscateToolArguments(obfuscator: SecretObfuscator, args: Record<string, unknown>): Record<string, unknown>;
/** Redact secrets inside a tool call's arguments (same JSON-walk exception as {@link deobfuscateToolArguments}). */
export declare function obfuscateToolArguments(obfuscator: SecretObfuscator, args: Record<string, unknown>): Record<string, unknown>;
/**
 * Redact secrets from outbound messages. Opt-in by origin: only user messages,
 * tool results, and user-authored developer messages (e.g. `@file` mentions)
 * can carry operator secrets. System prompts, tool schemas, and assistant
 * output are author-controlled or model-generated and pass through untouched.
 * Within a targeted message only `text` blocks are rewritten — inline image
 * bytes are never walked.
 */
export declare function obfuscateMessages(obfuscator: SecretObfuscator, messages: Message[]): Message[];
/**
 * Redact outbound provider context. Only conversation messages are rewritten;
 * the static system prompt and tool schemas pass through unchanged.
 */
export declare function obfuscateProviderContext(obfuscator: SecretObfuscator | undefined, context: Context): Context;
