/**
 * Safe-echo policy for values that failed local (client-side) validation.
 *
 * A value rejected by a format/existence check is a value we know nothing
 * about — the CLI has only established what it is NOT. The likeliest
 * failure is an ordinary typo, but the second likeliest, demonstrated in
 * practice, is a credential pasted into the wrong slot: a Base-mainnet
 * private key holding real funds lands in `RUN402_WALLET` (which takes a
 * wallet NAME, not a key), fails the name check, and is printed verbatim to
 * a terminal, a log, and a session transcript.
 *
 * `describeRejectedValue` is the one place that decides what a rejected
 * value is safe to show, so every call site — wallet names, org ids, room
 * keys, unknown commands/subcommands, "not found" lookups — gets the same
 * answer instead of each reinventing (or forgetting) the judgment call.
 *
 * Short, low-entropy values (ordinary typos) are returned unchanged — that
 * is what makes the resulting error message useful. Long or
 * high-entropy-looking values are replaced with a shape-only description
 * (character count only), never a substring or prefix of the original:
 * even a short prefix of a private key is more than a debugging aid needs
 * and more than a leak should give up.
 *
 * This is a heuristic, not a content-aware secret scanner: treat "returned
 * unchanged" as "short and plain enough to be a typo," not as proof the
 * value holds no secret. Callers with a value that is never supposed to be
 * secret-shaped in the first place (a service key, an admin key) should
 * still never echo it at all, redacted or not — this helper is for slots
 * that normally hold a plain identifier and occasionally, by mistake,
 * don't.
 */
/**
 * Return `value` unchanged when it is short and plain enough to be a
 * harmless typo; otherwise return a shape-only placeholder (character count
 * only — never a substring) that is still safe to embed in a message or a
 * structured `details` field.
 *
 * Never throws. Coerces non-string input the same way template-literal
 * interpolation would, so a caller can pass whatever it already has without
 * a separate type check.
 */
export declare function describeRejectedValue(value: unknown): string;
//# sourceMappingURL=redact.d.ts.map