/**
 * Secret-bearing flag values for imperative infra commands.
 *
 * Follows the same convention as `lobu apply` config (`secret()` / `$VAR`):
 * a value starting with `$` names an environment variable resolved at call
 * time. The reference must be single-quoted on the command line
 * (`--key '$MY_KEY'`) — unquoted, the shell expands it before the CLI runs
 * and the real secret lands in argv anyway.
 */
/** Resolve a flag value that may be a `$VAR` environment reference. */
export declare function resolveSecretFlag(raw: string, flagName: string): string;
/**
 * Parse repeatable `key=value` flag entries into a record. Values follow the
 * `$VAR` convention above, so `--credential 'token=$VERCEL_TOKEN'` reads the
 * env var instead of putting the token on the command line. Errors reference
 * entries only by index, never by content — a mistakenly pasted secret must
 * not end up on stderr, and even the "key" part can be one (`sk-live-…=`).
 */
export declare function parseKeyValueEntries(entries: string[], flagName: string): Record<string, string>;
//# sourceMappingURL=secret-value.d.ts.map