export declare function loadMasterKey(dataDir: string): Buffer;
export declare function encrypt(plaintext: string, masterKey: Buffer): string;
export declare function decrypt(stored: string, masterKey: Buffer): string;
export declare function encryptEnv(data: Record<string, string>, masterKey: Buffer): string;
export declare function decryptEnv(stored: string, masterKey: Buffer): Record<string, string>;
/**
 * Check if a string looks like an encrypted env (hex:hex:hex format).
 * Plaintext JSON objects start with '{'.
 */
export declare function isEncryptedEnv(value: string): boolean;
export declare function timeSafeCompare(a: string, b: string): boolean;
export declare function sanitizeLogs(output: string, envVars?: Record<string, string>): string;
export declare function maskValue(value: string): string;
export declare function maskCredentials(creds: Record<string, string>): Record<string, string>;