/**
 * Reading a project's .env file to find the values that are secrets, so they can be saved to the workspace's secrets (and then used as
 * `{ "secret": "NAME" }` in a release's configuration). Everything here is pure and works on text; nothing here prints, logs or returns a
 * value except `parseDotenv`, whose output stays inside the command and goes only to the workspace. A result meant for a person or an
 * assistant (`describePlan`) carries names, reasons and lengths, never any part of a value.
 */
export interface IEnvEntry {
    name: string;
    value: string;
    /** 1-based line the entry starts on. */
    line: number;
    /** True when the same name appears again later in the file, which wins. */
    duplicate?: boolean;
}
/**
 * Reads dotenv text: `NAME=value`, an optional `export `, single and double quotes (a double-quoted value may span lines and uses \n, \t and \"
 * escapes), `#` comments on their own line or after an unquoted value, and blank lines. A name that is not a valid variable name is skipped.
 * When a name appears more than once the last one wins, as in every dotenv loader.
 */
export declare function parseDotenv(text: string): IEnvEntry[];
export type Classification = 'secret' | 'config' | 'skip';
export interface IClassified {
    name: string;
    classification: Classification;
    /** Why, in words, from the name or the shape of the value. Never the value. */
    reason: string;
}
/**
 * Decides whether an entry looks like a secret, from its name and the shape of its value. It is a guide, not a judgement: the person (or the
 * assistant, with the person) chooses what to save, with `--only` and `--all`. A value is only ever looked at, never kept or shown.
 */
export declare function classifyEntry(entry: IEnvEntry): IClassified;
export interface IScanOptions {
    /** Save every entry that has a real value, whatever it looks like. */
    all?: boolean;
    /** Save exactly these names, whatever they look like (they must be in the file). */
    only?: string[];
    /** Never save these names. */
    exclude?: string[];
    /** Added in front of each name to make the workspace secret's key. */
    prefix?: string;
    /** Replace a secret that already exists. Without it an existing secret is left alone. */
    overwrite?: boolean;
}
export type ScanAction = 'create' | 'update' | 'exists' | 'config' | 'skip' | 'excluded';
export interface IScanRow extends IClassified {
    /** The key it would be saved under. */
    key: string;
    action: ScanAction;
    /** How long the value is. Not the value. */
    length: number;
    duplicate?: boolean;
}
/** What would be saved, and why each of the rest is not. Pure: no value leaves this function except as a length. */
export declare function planScan(entries: IEnvEntry[], existingKeys: ReadonlySet<string>, options?: IScanOptions): IScanRow[];
/** What a person or an assistant is shown. Names, the decision, the reason and a length: never any part of a value. */
export declare function describePlan(rows: IScanRow[], source: string, applied: boolean): Record<string, unknown>;