/**
 * Shared input-mode helper for `kici-admin secret set` and
 * `kici-admin variable set`.
 *
 * Resolves a value from exactly one of:
 *   --value <plaintext>   — argv literal (warned; goes into shell history)
 *   --prompt              — interactive no-echo prompt (TTY only)
 *   --from-stdin          — pipe (full stdin until EOF)
 *   --from-file <path>    — file contents (--trim default-on)
 *   --from-env  <VAR>     — env var contents
 *
 * Default-mode resolution when no flag is provided:
 *   TTY     -> --prompt
 *   non-TTY -> --from-stdin
 *
 * Optional checks:
 *   --confirm-fingerprint <hex>  — SHA-256 fingerprint guard against
 *     paste corruption.
 *
 * The helper does NOT print to stdout (it returns the value). It DOES
 * write to stderr for the `--value` warning, the prompt label, and any
 * "empty value" warning. Stdout is reserved for the caller's confirmation
 * output so the caller's `--dry-run` summary stays clean.
 */
export interface SecretInputOptions {
    value?: string;
    fromStdin?: boolean;
    fromFile?: string;
    fromEnv?: string;
    prompt?: boolean;
    trim?: boolean;
    confirmFingerprint?: string;
}
export interface SecretInputResult {
    value: string;
    /** Which input mode supplied the value (after default resolution). */
    source: 'value' | 'stdin' | 'file' | 'env' | 'prompt';
}
export declare function resolveSecretInput(opts: SecretInputOptions, stderr?: NodeJS.WritableStream, stdin?: NodeJS.ReadStream): Promise<SecretInputResult>;
/**
 * Compute the canonical SHA-256 fingerprint for a value. Helper for
 * callers (tests, --dry-run output) that want to display the same hex
 * the user would pass to `--confirm-fingerprint`.
 */
export declare function fingerprintValue(value: string): string;
//# sourceMappingURL=secret-input.d.ts.map