/**
 * Secret environment variable guard
 *
 * Environment variables whose names mark them as secrets (API keys, tokens,
 * passwords) must never be set by typing `export KEY="value"` into a
 * terminal: the shell echoes the line, so the value lands in scrollback, in
 * the persistent session log (~/.crewly/logs/sessions/) and in the
 * terminal-output API. Secrets go into a session through its spawn
 * environment instead (`createSession(..., { env })`).
 *
 * @module utils/secret-env
 */
/**
 * Whether an environment variable name denotes a secret.
 *
 * @param key - Environment variable name
 * @returns True for names like OPENAI_API_KEY, ANTHROPIC_API_KEY, GITHUB_TOKEN
 *
 * @example
 * ```ts
 * isSecretEnvKey('GEMINI_API_KEY'); // true
 * isSecretEnvKey('CREWLY_SESSION_NAME'); // false
 * ```
 */
export declare function isSecretEnvKey(key: string): boolean;
/**
 * Throws when asked to type a secret into a terminal.
 *
 * The error names the variable only, never the value.
 *
 * @param key - Environment variable name about to be exported in a terminal
 * @throws Error when `key` is a secret name (see isSecretEnvKey)
 */
export declare function assertNotSecretEnvKey(key: string): void;
/** A secret's variable name and value, for masking by value */
export interface SecretEnvValue {
    /** Variable name, used in the mask */
    name: string;
    /** The secret value to mask wherever it appears */
    value: string;
}
/**
 * Collects the values of every secret-named variable in one or more env maps.
 *
 * Used to mask secrets by exact value, which catches secrets no pattern can
 * recognise (a Slack signing secret is plain hex). Longest values come first
 * so a value that contains another is masked whole.
 *
 * @param envs - Env maps to read (e.g. process.env and a session's spawn env)
 * @returns Distinct secret values with their names, longest first
 */
export declare function collectSecretEnvValues(...envs: ReadonlyArray<Record<string, string | undefined> | undefined>): SecretEnvValue[];
/**
 * Replaces every occurrence of the given secret values with `[REDACTED <NAME>]`.
 *
 * @param text - Text to mask
 * @param secrets - Values to mask (see collectSecretEnvValues)
 * @returns The text with every listed value masked
 */
export declare function redactSecretEnvValues(text: string, secrets: readonly SecretEnvValue[]): string;
//# sourceMappingURL=secret-env.d.ts.map