import type { Spec, ValidatorSpec } from 'envalid';
/** A `Spec` may carry `secret: true` to mark the var sensitive on its own,
 *  independently of whether it was declared in `env()`'s `secrets` argument. */
export type SecretSpec = {
    secret?: boolean;
};
declare module 'envalid' {
    interface Spec<T> {
        /** Never print this value in a validation error or in serialized output. */
        secret?: boolean;
    }
}
export declare const isSecretSpec: (spec: ValidatorSpec<unknown> | Spec<unknown>) => boolean;
/** Strip a spec's `secret` marker before handing it to envalid (which would
 *  otherwise carry an unknown key through its spec objects). */
export declare const stripSecret: <S extends Record<string, ValidatorSpec<unknown>>>(specs: S) => S;
/**
 * The reported message for a failed secret var: names the var and the failure,
 * never the value. A MISSING var has no value to leak, so its message (the
 * spec description) is kept verbatim — that is the part that tells an operator
 * what to set.
 */
export declare const redactMessage: (error: Error, rawValue: string | undefined) => string;
/**
 * Scrub secrets out of an error before re-logging it. Quoted values in envalid
 * messages are always replaced; pass known secret values to remove them
 * wherever else they appear (a message a consumer built itself).
 *
 * ```ts
 * try { loadConfig(); } catch (err) { logger.error(redactEnvError(err)); }
 * ```
 */
export declare const redactEnvError: (error: unknown, secretValues?: Iterable<string | undefined>) => Error;
/**
 * Make the cleaned env safe to log wholesale: services log their config object
 * at boot, and `JSON.stringify`/`util.inspect` would print every secret. The
 * values stay readable through property access; only serialization redacts.
 *
 * Must be applied to the PLAIN cleaned object, before envalid's strict proxy and
 * `Object.freeze` (whose non-configurable props can no longer be defined on);
 * envalid's proxy passes `toJSON` and the inspect symbol through to the target.
 */
export declare const withRedactedSerialization: <T extends object>(cleaned: T, secretNames: ReadonlySet<string>) => T;