export type SecretValueSources = {
    /** --from-env VAR: the NAME of a local environment variable to copy. */
    fromEnv?: string;
    stdinIsTty: boolean;
    readStdin: () => Promise<string>;
    /** Hidden prompt; resolves undefined when the user cancels (ctrl-C / EOF). */
    promptHidden: (name: string) => Promise<string | undefined>;
    env: NodeJS.ProcessEnv;
};
export type SecretValueResult = {
    kind: "value";
    value: string;
} | {
    kind: "canceled";
} | {
    kind: "error";
    message: string;
};
/** Where a secret's value comes from, in precedence order: --from-env wins;
 *  else piped stdin; else the hidden TTY prompt. Never argv. */
export declare function resolveSecretValue(name: string, sources: SecretValueSources): Promise<SecretValueResult>;
/** One terminal "\r\n" or "\n" removed — exactly one, so a value meant to keep
 *  a final newline supplies two (printf 'value\n\n'). Interior newlines are
 *  untouched. */
export declare function stripOneTrailingNewline(text: string): string;
export type ParsedEnvSource = {
    /** First-insertion key order; on a duplicate key the LAST assignment's value
     *  wins (in the original position). No duplicate reporting — a `B=` line
     *  inside a multiline quoted value is NOT an assignment, and
     *  last-value-wins is the behavior that matters. */
    entries: {
        name: string;
        value: string;
    }[];
};
/** A small, OWNED dotenv parser. Deliberately not node:util's parseEnv: its
 *  quoted-value handling differs across Node releases inside the supported
 *  engine range (22.13.0 mis-splits `B="x=y"` into a bogus extra entry), and
 *  secret values must parse identically on every supported version. Semantics
 *  (pinned by tests): `NAME=value` lines; optional `export ` prefix; `#`
 *  comments and blank lines skipped; single- or double-quoted values may span
 *  lines and keep `=`/`#` literally; quoted content is LITERAL (no escape
 *  expansion); unquoted values run to end of line, trimmed. Never touches
 *  process.env. */
export declare function parseEnvSource(text: string): ParsedEnvSource;
/** Single-line, terminal-safe rendering for untrusted display text (names,
 *  server messages): a string containing terminal-control characters is
 *  JSON-quoted so it cannot manipulate the terminal; plain strings pass
 *  through unchanged. "Control" covers C0, DEL, and the C1 range (U+009B is a
 *  bare CSI) plus the U+2028/U+2029 line separators — and because
 *  JSON.stringify escapes only C0, the quoted form is post-processed so every
 *  such character ends up as a \\uXXXX escape. Always applied AFTER
 *  redaction. */
export declare function terminalSafe(text: string): string;