@envseal/core 0.1.0

package/dist/guard.js

@@ -0,0 +1,157 @@
+import { detect } from '@envseal/detector';
+import { SepError } from '@envseal/protocol';
+function tierAccepts(tier, confidence) {
+    return tier === 'strict' || confidence === 'high';
+}
+/** Minimum run of one repeated character before a span reads as filler. */
+const MIN_PLACEHOLDER_RUN = 8;
+/** …and how much of the span that run must cover. */
+const MIN_PLACEHOLDER_RUN_RATIO = 0.4;
+function longestRun(span) {
+    let best = 0;
+    let run = 0;
+    let previous = '';
+    for (const ch of span) {
+        run = ch === previous ? run + 1 : 1;
+        previous = ch;
+        if (run > best)
+            best = run;
+    }
+    return best;
+}
+function collapseRuns(span) {
+    return span.replace(/([\s\S])\1{2,}/g, '$1');
+}
+/**
+ * `sk-XXXXXXXXXXXXXXXXXXXX`, `AKIA11111111111111XX`, `ghp_XXXX…` — filler, not
+ * credentials. This filter is load-bearing rather than a nicety: 26 of the 393
+ * strings shipped in `packages/registry/providers/*.json` are placeholders of
+ * exactly this shape, and `Broker.declare` copies a registry `format` onto any
+ * entry that omits one. Without the filter, declaring any registry-known key —
+ * and every `envseal init` on a project that mentions one — would fail closed
+ * against our own bundled data.
+ *
+ * Padding a real credential with filler does not get past this. The run has to
+ * dominate the span (≥40%), and even then the span is re-scanned with its runs
+ * collapsed: `sk-proj-<20 real chars>XXXXXXXXXXXXXXXXXXXX` still matches after
+ * collapsing, so it is not treated as a placeholder. Random key material
+ * essentially never contains an 8-character run — for a 48-character base62
+ * body the probability is on the order of 1e-11.
+ */
+function isRunPlaceholder(span) {
+    const run = longestRun(span);
+    if (run < MIN_PLACEHOLDER_RUN)
+        return false;
+    if (run / span.length < MIN_PLACEHOLDER_RUN_RATIO)
+        return false;
+    return detect(collapseRuns(span)).length === 0;
+}
+/**
+ * Words that carry no key material, so a span built only from them is a
+ * template rather than a value. This exists for one shape that the run filter
+ * cannot see: `postgresql://USERNAME:PASSWORD@localhost:5432/mydb`, which the
+ * connection-string pattern matches at high confidence and which is the most
+ * natural thing to write in a DATABASE_URL description.
+ *
+ * Matching is per whole segment, never per substring, so a real password sitting
+ * next to these words still rejects: `postgres://user:hunter2ThisIsReal@host`
+ * has a segment that is not in this list.
+ */
+const PLACEHOLDER_WORDS = new Set([
+    'postgres', 'postgresql', 'mysql', 'mongodb', 'srv', 'redis', 'amqp',
+    'user', 'username', 'pass', 'password', 'passwd', 'host', 'hostname',
+    'localhost', 'port', 'dbname', 'database', 'example', 'com', 'net', 'org',
+    'your', 'key', 'apikey', 'token', 'secret', 'value', 'redacted', 'changeme',
+    'placeholder', 'foo', 'bar', 'baz', 'qux', 'xxx', 'yyy', 'zzz', 'abc',
+    'none', 'null', 'here', 'todo', 'sample', 'dummy',
+]);
+function isVocabularyPlaceholder(span) {
+    const segments = span.match(/[A-Za-z0-9]{3,}/g);
+    if (segments === null)
+        return false;
+    return segments.every((segment) => PLACEHOLDER_WORDS.has(segment.toLowerCase()));
+}
+function isPlaceholder(span) {
+    return isRunPlaceholder(span) || isVocabularyPlaceholder(span);
+}
+/**
+ * The first credential-shaped span in `text`, or null. The returned finding
+ * deliberately carries no offsets and no excerpt — an offset pair plus a
+ * repeatable call is itself a substring oracle over the input.
+ */
+export function scanText(path, text, tier) {
+    for (const detection of detect(text)) {
+        if (!tierAccepts(tier, detection.confidence))
+            continue;
+        if (isPlaceholder(text.slice(detection.start, detection.end)))
+            continue;
+        return { path, label: detection.label, confidence: detection.confidence };
+    }
+    return null;
+}
+function scanOptional(path, text, tier) {
+    return text === undefined ? null : scanText(path, text, tier);
+}
+/**
+ * Every free-text string on a parsed entry that reaches `env.schema.jsonc`.
+ *
+ * `key` is scanned at `high-only`, alone among the fields. It is the one field
+ * whose content is not the caller's to rephrase — it is the environment
+ * variable's actual name — so a false positive there is unfixable rather than
+ * merely annoying, and the generic entropy tier does produce them:
+ * `STRIPE_WEBHOOK_SIGNING_SECRET_V2` is a plausible name that scores as a
+ * medium-confidence hit. High-confidence patterns still apply, so a key named
+ * `AKIAT7QLM2XP9RV4NC3B` is rejected. Non-string fields (booleans, numbers,
+ * `sink`, `verify.method`) cannot carry a value past their zod types and are
+ * not scanned.
+ */
+export function scanManifestEntry(entry, basePath) {
+    const at = (field) => `${basePath}.${field}`;
+    const findings = [
+        scanText(at('key'), entry.key, 'high-only'),
+        scanText(at('description'), entry.description, 'strict'),
+        scanOptional(at('format.pattern'), entry.format?.pattern, 'strict'),
+        scanOptional(at('format.example'), entry.format?.example, 'strict'),
+        scanOptional(at('provider.id'), entry.provider?.id, 'strict'),
+        scanOptional(at('provider.name'), entry.provider?.name, 'strict'),
+        scanOptional(at('provider.signupUrl'), entry.provider?.signupUrl, 'strict'),
+        scanOptional(at('provider.docsUrl'), entry.provider?.docsUrl, 'strict'),
+        scanOptional(at('provider.rotateUrl'), entry.provider?.rotateUrl, 'strict'),
+        scanOptional(at('verify.url'), entry.verify?.url, 'strict'),
+    ];
+    const scopes = entry.provider?.scopesNeeded ?? [];
+    for (const [index, scope] of scopes.entries()) {
+        findings.push(scanText(at(`provider.scopesNeeded[${index}]`), scope, 'strict'));
+    }
+    // Header VALUES are the sharpest edge on the entry: `{ "Authorization":
+    // "Bearer sk-proj-…" }` is both a manifest leak and a live credential handed
+    // to whatever host verify.url points at. Header NAMES are scanned too; they
+    // are equally free text.
+    for (const [name, template] of Object.entries(entry.verify?.headerTemplate ?? {})) {
+        findings.push(scanText(at(`verify.headerTemplate.${name}`), name, 'strict'));
+        findings.push(scanText(at(`verify.headerTemplate.${name}`), template, 'strict'));
+    }
+    return findings.find((finding) => finding !== null) ?? null;
+}
+export function secretInDeclarationError(finding) {
+    return new SepError({
+        code: 'SEP_VALUE_IN_REQUEST',
+        userMessage: `Refusing to declare: ${finding.path} looks like a real credential (${finding.label}). ` +
+            'Manifest fields are metadata and are committed to git, so they must never contain a value. ' +
+            'Describe the key instead — "starts with sk-proj-", or a placeholder such as ' +
+            '"sk-proj-XXXXXXXXXXXXXXXXXXXX" — and let the user supply the value through the prompt ' +
+            'that env_request opens. A value must never appear in a declaration.',
+        details: { field: finding.path, detected: finding.label, confidence: finding.confidence },
+    });
+}
+export function secretInRequestError(finding) {
+    return new SepError({
+        code: 'SEP_VALUE_IN_REQUEST',
+        userMessage: `Refusing to open a request: ${finding.path} looks like a real credential (${finding.label}). ` +
+            'The reason is written to the audit log, which records key names only. ' +
+            'Say why the key is needed without quoting any value — env_request exists so that the user ' +
+            'types the value into a prompt you never see, so it must never be in the request itself.',
+        details: { field: finding.path, detected: finding.label, confidence: finding.confidence },
+    });
+}
+//# sourceMappingURL=guard.js.map

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+export * from './paths.js';
+export * from './manifest.js';
+export * from './presence.js';
+export * from './redact.js';
+export * from './tickets.js';
+export * from './audit.js';
+export * from './sinks/types.js';
+export { parseDotenv, serializeDotenv, readDotenv, setDotenvValue, removeDotenvKey, DotenvSink, } from './sinks/dotenv.js';
+export type { DotenvLine, ParsedDotenv, WriteDotenvOptions } from './sinks/dotenv.js';
+export * from './approvals.js';
+export * from './verify.js';
+export * from './exec.js';
+export * from './sinks/registry.js';
+export { keychainSink } from './sinks/keychain.js';
+export * from './broker.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,15 @@
+export * from './paths.js';
+export * from './manifest.js';
+export * from './presence.js';
+export * from './redact.js';
+export * from './tickets.js';
+export * from './audit.js';
+export * from './sinks/types.js';
+export { parseDotenv, serializeDotenv, readDotenv, setDotenvValue, removeDotenvKey, DotenvSink, } from './sinks/dotenv.js';
+export * from './approvals.js';
+export * from './verify.js';
+export * from './exec.js';
+export * from './sinks/registry.js';
+export { keychainSink } from './sinks/keychain.js';
+export * from './broker.js';
+//# sourceMappingURL=index.js.map

package/dist/manifest.d.ts

@@ -0,0 +1,24 @@
+import { DeclareResult } from '@envseal/protocol';
+import type { Manifest as ManifestType } from '@envseal/protocol';
+import type { ProjectPaths } from './paths.js';
+export declare function emptyManifest(): ManifestType;
+/**
+ * Load the manifest, or null when there is no manifest file.
+ *
+ * "Absent" and "unreadable" are different answers and must not share a return
+ * value. Collapsing them meant a truncated or schema-invalid manifest read as
+ * an empty one, and the next `env_declare` cheerfully wrote a fresh file over
+ * it — silently discarding every prior declaration while the corrupting field
+ * remained, so the cycle repeated. A corrupt manifest now throws; callers that
+ * genuinely tolerate absence still get null.
+ */
+export declare function loadManifest(paths: ProjectPaths): ManifestType | null;
+export declare function saveManifest(paths: ProjectPaths, manifest: ManifestType): void;
+/**
+ * Every write to `env.schema.jsonc` funnels through here — `Broker.declare` and
+ * the CLI's `init` both call it — so this is where the secret-shaped-input
+ * guard belongs. Placing it in `Broker.declare` alone would leave `envseal init`
+ * unguarded, and placing it after `saveManifest` would be no guard at all.
+ */
+export declare function declareEntries(paths: ProjectPaths, entries: unknown[]): DeclareResult;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.js

@@ -0,0 +1,165 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { isDeepStrictEqual } from 'node:util';
+import * as jsonc from 'jsonc-parser';
+import { DeclareResult, Manifest, ManifestEntry, SepError } from '@envseal/protocol';
+import { appendAudit } from './audit.js';
+import { scanManifestEntry, secretInDeclarationError } from './guard.js';
+export function emptyManifest() {
+    return { version: 1, entries: [] };
+}
+function readFileIfPresent(path) {
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        return null;
+    }
+}
+function detectFormat(text) {
+    const eol = text.includes('\r\n') ? '\r\n' : '\n';
+    const indent = /^[ \t]+/m.exec(text)?.[0];
+    const insertSpaces = indent === undefined ? true : !indent.startsWith('\t');
+    const tabSize = indent !== undefined && insertSpaces ? indent.length : 2;
+    return { insertSpaces, tabSize, eol };
+}
+const MANIFEST_FIELDS = ['$schema', 'version', 'entries'];
+/**
+ * Load the manifest, or null when there is no manifest file.
+ *
+ * "Absent" and "unreadable" are different answers and must not share a return
+ * value. Collapsing them meant a truncated or schema-invalid manifest read as
+ * an empty one, and the next `env_declare` cheerfully wrote a fresh file over
+ * it — silently discarding every prior declaration while the corrupting field
+ * remained, so the cycle repeated. A corrupt manifest now throws; callers that
+ * genuinely tolerate absence still get null.
+ */
+export function loadManifest(paths) {
+    const text = readFileIfPresent(paths.manifest);
+    if (text === null)
+        return null;
+    const errors = [];
+    const value = jsonc.parse(text, errors, {
+        disallowComments: false,
+        allowTrailingComma: false,
+        allowEmptyContent: false,
+    });
+    if (errors.length > 0) {
+        throw new SepError({
+            code: 'SEP_FORMAT_INVALID',
+            userMessage: `${paths.manifest} is not valid JSONC and was not overwritten. ` +
+                'Fix the syntax, or delete the file to start a fresh manifest.',
+        });
+    }
+    const result = Manifest.safeParse(value);
+    if (!result.success) {
+        const detail = result.error.issues
+            .slice(0, 3)
+            .map((i) => `${i.path.join('.') || '(root)'}: ${i.message}`)
+            .join('; ');
+        throw new SepError({
+            code: 'SEP_FORMAT_INVALID',
+            userMessage: `${paths.manifest} does not match the manifest schema and was not overwritten (${detail}). ` +
+                'Fix the file, or delete it to start a fresh manifest.',
+        });
+    }
+    return result.data;
+}
+function renderFreshManifest(manifest) {
+    const body = `{
+  "version": ${manifest.version},
+  "entries": ${JSON.stringify(manifest.entries, null, 2)}
+}
+`;
+    return [
+        '// envseal manifest — declares which environment variables this project uses.',
+        '// Values are NEVER stored here; only metadata. Declare with env_declare.',
+        '// JSON Schema: spec/sep-1/manifest.schema.json in the envseal repo (kept as a',
+        '// comment: a $schema field would dangle in every project but this one).',
+        body,
+    ].join('\n');
+}
+export function saveManifest(paths, manifest) {
+    const text = readFileIfPresent(paths.manifest);
+    if (text === null) {
+        writeFileSync(paths.manifest, renderFreshManifest(manifest));
+        return;
+    }
+    const errors = [];
+    const existing = jsonc.parse(text, errors, { disallowComments: false });
+    if (typeof existing !== 'object' || existing === null) {
+        throw new SepError({
+            code: 'SEP_FORMAT_INVALID',
+            details: 'Cannot edit an unparseable manifest without losing its comments.',
+        });
+    }
+    const existingRecord = existing;
+    const formatting = detectFormat(text);
+    let out = text;
+    for (const field of MANIFEST_FIELDS) {
+        const next = manifest[field];
+        if (next === undefined)
+            continue;
+        if (isDeepStrictEqual(existingRecord[field], next))
+            continue;
+        const edits = jsonc.modify(out, [field], next, { formattingOptions: formatting });
+        out = jsonc.applyEdits(out, edits);
+    }
+    writeFileSync(paths.manifest, out);
+}
+/**
+ * Every write to `env.schema.jsonc` funnels through here — `Broker.declare` and
+ * the CLI's `init` both call it — so this is where the secret-shaped-input
+ * guard belongs. Placing it in `Broker.declare` alone would leave `envseal init`
+ * unguarded, and placing it after `saveManifest` would be no guard at all.
+ */
+export function declareEntries(paths, entries) {
+    const manifest = loadManifest(paths) ?? emptyManifest();
+    const parsedEntries = [];
+    for (const [index, raw] of entries.entries()) {
+        const result = ManifestEntry.safeParse(raw);
+        if (!result.success) {
+            const hasUnrecognized = result.error.issues.some((issue) => issue.code === 'unrecognized_keys');
+            throw new SepError({
+                code: hasUnrecognized ? 'SEP_VALUE_IN_REQUEST' : 'SEP_FORMAT_INVALID',
+                details: result.error.flatten(),
+            });
+        }
+        const finding = scanManifestEntry(result.data, `entries[${index}]`);
+        if (finding !== null) {
+            // §2.2 T3 wants the rejection logged as well as surfaced. The record
+            // carries the field path and the pattern label — never the text that
+            // matched, which is the whole reason we are refusing the write.
+            appendAudit(paths, {
+                type: 'blocked',
+                reason: 'secret_in_declaration',
+                detail: `${finding.path}: ${finding.label}`,
+            });
+            throw secretInDeclarationError(finding);
+        }
+        parsedEntries.push(result.data);
+    }
+    const byKey = new Map(manifest.entries.map((entry) => [entry.key, entry]));
+    const added = [];
+    const updated = [];
+    const unchanged = [];
+    for (const entry of parsedEntries) {
+        const existing = byKey.get(entry.key);
+        if (existing === undefined) {
+            byKey.set(entry.key, entry);
+            added.push(entry.key);
+        }
+        else if (isDeepStrictEqual(existing, entry)) {
+            unchanged.push(entry.key);
+        }
+        else {
+            byKey.set(entry.key, entry);
+            updated.push(entry.key);
+        }
+    }
+    manifest.entries = [...byKey.values()];
+    saveManifest(paths, manifest);
+    return { added, updated, unchanged };
+}
+//# sourceMappingURL=manifest.js.map

package/dist/paths.d.ts

@@ -0,0 +1,14 @@
+export interface ProjectPaths {
+    root: string;
+    manifest: string;
+    dotenv: string;
+    stateDir: string;
+    salt: string;
+    approvals: string;
+    audit: string;
+}
+export declare function projectPaths(root: string): ProjectPaths;
+export declare function findProjectRoot(startDir: string): string;
+export declare function ensureStateDir(paths: ProjectPaths): void;
+export declare function loadOrCreateSalt(paths: ProjectPaths): Buffer;
+//# sourceMappingURL=paths.d.ts.map

package/dist/paths.js

@@ -0,0 +1,87 @@
+import { randomBytes } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+export function projectPaths(root) {
+    const normalizedRoot = resolve(root);
+    return {
+        root: normalizedRoot,
+        manifest: join(normalizedRoot, 'env.schema.jsonc'),
+        dotenv: join(normalizedRoot, '.env'),
+        stateDir: join(normalizedRoot, '.envseal'),
+        salt: join(normalizedRoot, '.envseal', 'salt'),
+        approvals: join(normalizedRoot, '.envseal', 'approvals.json'),
+        audit: join(normalizedRoot, '.envseal', 'audit.jsonl'),
+    };
+}
+export function findProjectRoot(startDir) {
+    let dir = resolve(startDir);
+    const original = dir;
+    for (;;) {
+        if (existsSync(join(dir, 'env.schema.jsonc')))
+            return dir;
+        if (existsSync(join(dir, '.git')))
+            return dir;
+        if (existsSync(join(dir, 'package.json')))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return original;
+        dir = parent;
+    }
+}
+const isPosix = process.platform !== 'win32';
+/**
+ * A nested .gitignore of `*` makes everything under `.envseal/` invisible to
+ * git regardless of what the project's own .gitignore says. The dotenv sink
+ * stages its plaintext temp file here (F-W7-3), and a project .gitignore
+ * containing `.env` does not cover `.envseal/` — nor did it cover the old
+ * sibling temp name `..env.<hex>.tmp`.
+ */
+const STATE_GITIGNORE = '# Written by envseal: nothing in here belongs in version control.\n*\n';
+export function ensureStateDir(paths) {
+    mkdirSync(paths.stateDir, { recursive: true, mode: 0o700 });
+    if (isPosix)
+        chmodSync(paths.stateDir, 0o700);
+    const guard = join(paths.stateDir, '.gitignore');
+    if (!existsSync(guard)) {
+        writeFileSync(guard, STATE_GITIGNORE, { mode: 0o600 });
+    }
+}
+/**
+ * F-W7-5: a truncated salt file used to be replaced in complete silence. The
+ * salt keys every `fp_*` fingerprint in `describe()` output and in the audit
+ * log, so a silent swap makes every previously recorded fingerprint mean
+ * something different. Regenerating is still the right default — refusing to
+ * start over a file the user can simply delete would be worse — but it must be
+ * announced.
+ *
+ * stderr ONLY: stdout is a machine-readable JSON channel for several bindings
+ * and the MCP server speaks JSON-RPC on it.
+ */
+function warnSaltReplaced(actualLength) {
+    process.stderr.write(`envseal: .envseal/salt is ${actualLength} bytes, expected 32 — generating a new salt. ` +
+        'Every fp_* fingerprint recorded before now was derived from the old salt ' +
+        'and will no longer match.\n');
+}
+export function loadOrCreateSalt(paths) {
+    ensureStateDir(paths);
+    let truncatedLength = null;
+    try {
+        const existing = readFileSync(paths.salt);
+        if (existing.length === 32)
+            return existing;
+        truncatedLength = existing.length;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (truncatedLength !== null)
+        warnSaltReplaced(truncatedLength);
+    const salt = randomBytes(32);
+    writeFileSync(paths.salt, salt, { mode: 0o600 });
+    if (isPosix)
+        chmodSync(paths.salt, 0o600);
+    return salt;
+}
+//# sourceMappingURL=paths.js.map

package/dist/presence.d.ts

@@ -0,0 +1,20 @@
+import type { SecretValue } from '@envseal/protocol';
+import type { ProjectPaths } from './paths.js';
+export type PresenceSource = 'process-env' | 'dotenv' | 'sink' | 'absent';
+export interface Presence {
+    key: string;
+    present: boolean;
+    source: PresenceSource;
+    value: SecretValue | null;
+}
+export interface ResolvePresenceOptions {
+    /**
+     * Declared sink per key, taken from the manifest (`entry.sink ?? 'dotenv'`).
+     * A key mapped to a sink other than 'dotenv' is resolved through that sink,
+     * because that is where use()/verify() will actually read it; keys absent
+     * from the map keep the process-env/.env check exactly as before.
+     */
+    sinks?: ReadonlyMap<string, string>;
+}
+export declare function resolvePresence(paths: ProjectPaths, keys: string[], options?: ResolvePresenceOptions): Promise<Map<string, Presence>>;
+//# sourceMappingURL=presence.d.ts.map

package/dist/presence.js

@@ -0,0 +1,58 @@
+import { asSecret } from '@envseal/protocol';
+import { readDotenv } from './sinks/dotenv.js';
+import { getSink } from './sinks/registry.js';
+export async function resolvePresence(paths, keys, options) {
+    const env = process.env;
+    const dotenv = readDotenv(paths);
+    const out = new Map();
+    for (const key of keys) {
+        // process.env first for every key: runWithSecrets spawns the child with
+        // {...process.env}, so an exported value genuinely reaches the process.
+        const envValue = env[key];
+        if (envValue !== undefined) {
+            out.set(key, {
+                key,
+                present: true,
+                source: 'process-env',
+                value: asSecret(Buffer.from(envValue, 'utf8')),
+            });
+            continue;
+        }
+        const sinkId = options?.sinks?.get(key);
+        if (sinkId !== undefined && sinkId !== 'dotenv') {
+            let value = null;
+            try {
+                value = await getSink(sinkId).read(paths, key);
+            }
+            catch {
+                // A credential-store hiccup (locked keychain, DPAPI failure) must
+                // degrade to absent rather than crash describe/status — those are
+                // read-only reports that must answer even when a store is unhappy.
+                // The error still surfaces where it matters, in use()/verify().
+                value = null;
+            }
+            if (value !== null) {
+                out.set(key, { key, present: true, source: 'sink', value });
+                continue;
+            }
+            // No dotenv fallback here: a keychain-declared key is only resolvable
+            // through its declared sink, so a hand-written .env line must not make
+            // status claim present.
+            out.set(key, { key, present: false, source: 'absent', value: null });
+            continue;
+        }
+        const dotenvValue = dotenv[key];
+        if (dotenvValue !== undefined) {
+            out.set(key, {
+                key,
+                present: true,
+                source: 'dotenv',
+                value: asSecret(Buffer.from(dotenvValue, 'utf8')),
+            });
+            continue;
+        }
+        out.set(key, { key, present: false, source: 'absent', value: null });
+    }
+    return out;
+}
+//# sourceMappingURL=presence.js.map

package/dist/redact.d.ts

@@ -0,0 +1,20 @@
+import type { SecretValue } from '@envseal/protocol';
+export interface RedactResult {
+    text: string;
+    count: number;
+}
+/**
+ * Replace every occurrence of a stored value — and of the encodings in
+ * `variantsOf` — with an opaque token. Cost is O(text) in time and O(value) in
+ * memory, both bounded; nothing here compiles a pattern, so no input length can
+ * abort the process.
+ *
+ * When the text contains whitespace, a second scan runs over a
+ * whitespace-stripped dense copy with a dense→original index map (W2-F5: a
+ * value split across a line break emerges as a short head plus a suffix, and
+ * neither fragment alone may reach the detection window). Matches found dense
+ * are mapped back to original offsets and merged with the first pass's spans,
+ * so the joined fragments redact as one region including the separator.
+ */
+export declare function redact(text: string, secrets: Iterable<SecretValue>, labels?: Map<SecretValue, string>): RedactResult;
+//# sourceMappingURL=redact.d.ts.map