export declare function isSensitiveConfigKey(key: string): boolean;
/**
 * Replace any secret-bearing fields with the "***" sentinel before sending
 * config to the UI.
 * deepMerge round-trips the sentinel back to the original value on PUT.
 */
export declare function sanitizeConfigForApi<T>(value: T, key?: string): T;
/**
 * config.yaml as GET /api/config serves it: secrets replaced with the sentinel, and
 * only the keys a PUT may carry. GET and PUT are one round trip — the Settings page
 * saves back the document it was handed — so serving a key the PUT refuses ("Unknown
 * config keys: ...") makes every save from that page fail, and one key config.yaml
 * holds that this build does not declare is enough to do it. Dropping it here costs
 * nothing: a PUT deep-merges into the file, so what the body omits stays on disk.
 */
export declare function configDocumentForApi(config: object, savableKeys: string[]): Record<string, unknown>;
export declare function deepMerge(target: Record<string, unknown>, source: Record<string, unknown>): Record<string, unknown>;
//# sourceMappingURL=config-payload.d.ts.map