/**
 * Secret-masking helpers for the web env editor (GET/PUT /api/env).
 *
 * `maskSecret` produces the wire form returned in the masked GET:
 *   * empty → ''
 *   * ≤ 8 chars → repeated '*' of same length (so length is preserved
 *     for UI sizing but no info leaks)
 *   * > 8 chars → first 4 + asterisks + last 4 (operator can recognise
 *     "is this my prod key" without copy-pasting the secret)
 *
 * `isMasked` is the inverse check used on PUT to drop "client echoed
 * the mask back" updates so a real value isn't overwritten with
 * literal asterisks. The two functions MUST stay in sync — extracted
 * here as a module so the bun unit suite can assert that property
 * directly (see test/unit/env-mask.test.ts).
 *
 * Both functions are pure / dependency-free.
 */
export declare function maskSecret(v: string): string;
export declare function isMasked(value: string | undefined): boolean;
//# sourceMappingURL=env-mask.d.ts.map