export interface MaskResult {
    /** Masked .env contents — same shape as input but secret values redacted. */
    masked: string;
    /** Keys whose values were redacted. */
    redactedKeys: string[];
    /** Keys preserved (non-secret) — useful for re-install hint. */
    preservedKeys: string[];
}
/**
 * Test whether an .env key name matches a secret pattern.
 * Comparison is case-insensitive. `*` matches any prefix.
 */
export declare function isSecretKey(key: string, extraPatterns?: readonly string[]): boolean;
/**
 * Load user-defined secret key patterns from
 * `<workspace>/.solosquad/secret-keys.txt`. One pattern per line, `#` starts
 * a comment. Returns empty array if the file does not exist.
 */
export declare function loadUserSecretKeys(workspace: string): string[];
/**
 * Mask the contents of a .env file. Returns the masked text plus diagnostics.
 *
 * - Lines that are blank or comments are preserved verbatim.
 * - Lines of the form `KEY=VALUE` whose KEY matches a secret pattern get
 *   the VALUE replaced with `***REDACTED-AT-<iso-ts>***`.
 * - Non-secret KEY=VALUE pairs are preserved verbatim (so re-install can
 *   pick up `WORKSPACE_NAME` / `TIMEZONE`-style configuration).
 */
export declare function maskEnvContent(envText: string, options?: {
    extraPatterns?: readonly string[];
    nowIso?: string;
}): MaskResult;
/**
 * Convenience: mask a .env file in place. Returns the diagnostics. Does not
 * touch the file if `dryRun: true`.
 */
export declare function maskEnvFile(envPath: string, options?: {
    extraPatterns?: readonly string[];
    nowIso?: string;
    dryRun?: boolean;
}): MaskResult;
/**
 * Built-in patterns (read-only) — exposed for tests and doctor output.
 */
export declare const BUILTIN_SECRET_PATTERNS: readonly string[];