import { S as SerializedEnvGraph } from '../env-graph-DgoRWqJl.js';
import '@env-spec/parser';
import '@env-spec/utils/type-utils';

declare function resetRedactionMap(graph: SerializedEnvGraph): void;
/**
 * Returns the length of the longest suffix of `str` that is a partial match (proper prefix)
 * of a sensitive value. Used by streaming redaction to hold back trailing characters that
 * may be the beginning of a secret split across chunk boundaries.
 */
declare function getRedactionHoldbackLength(str: string): number;
/** Returns diagnostic info about the current redaction state (safe to expose — no secrets) */
declare function getRedactionMapInfo(): {
    sensitiveItemCount: number;
    hasRedactorRegex: boolean;
};
/**
 * Redacts senstive config values from any string/array/object/etc
 *
 * NOTE - must be used only after varlock has loaded config
 * */
declare function redactSensitiveConfig(o: any): any;
/**
 * utility to unmask a secret/sensitive value when logging to the console
 * currently this only works on a single secret, not objects or aggregated strings
 * */
declare function revealSensitiveConfig(secretStr: string): string;
declare function scanForLeaks(toScan: string | ReadableStream | null, meta?: {
    method?: string;
    file?: string;
}): string | ReadableStream<any> | null;
declare const varlockSettings: Record<string, any>;
declare function initVarlockEnv(opts?: {
    allowFail?: boolean;
}): void;
interface TypedEnvSchema {
}
declare const ENV: TypedEnvSchema;

export { ENV, type TypedEnvSchema, getRedactionHoldbackLength, getRedactionMapInfo, initVarlockEnv, redactSensitiveConfig, resetRedactionMap, revealSensitiveConfig, scanForLeaks, varlockSettings };
