/**
 * Resolve the mnemonic that should be used to sign, in precedence order:
 * `--mnemonic` flag / caller-supplied value > `MNEMONIC` env var >
 * `DOTNS_MNEMONIC` env var.
 *
 * `MNEMONIC` is the documented primary (README, `--help`, error messages
 * all name it first); `DOTNS_MNEMONIC` is the DotNS-scoped legacy alias.
 *
 * Empty-string / whitespace-only values are treated as unset rather than as
 * a valid (empty) mnemonic. Without this, a declared-but-blank env var (e.g.
 * a GitHub Actions `MNEMONIC: ${{ secrets.X }}` step where the secret was
 * never set, which resolves to `""`) would win over a real lower-precedence
 * value, or fall all the way through to DotNS's own dev-key default —
 * silently signing with the wrong key instead of falling back correctly.
 */
declare function resolveEffectiveMnemonic(opts: {
    flagMnemonic: string | undefined;
    envMnemonic: string | undefined;
    envDotnsMnemonic: string | undefined;
}): string | undefined;
/**
 * Pure notice for when `MNEMONIC` and `DOTNS_MNEMONIC` are both set to
 * different values, so the choice `resolveEffectiveMnemonic` makes between
 * them is observable rather than silent (#1461). Returns `null` when there
 * is nothing ambiguous to report (either is unset/blank, or they agree).
 *
 * Never includes either mnemonic's value — only the two env var names — so
 * this is safe to print to stdout/stderr without leaking key material.
 */
declare function mnemonicConflictNotice(opts: {
    envMnemonic: string | undefined;
    envDotnsMnemonic: string | undefined;
}): string | null;

export { mnemonicConflictNotice, resolveEffectiveMnemonic };