import type { z } from 'zod';
export declare const MAX_LISTED_FIELDS = 12;
export declare const OPAQUE_FIELD_SOURCES: ReadonlySet<string>;
/**
 * How a refusal names the fields the secret did carry.
 *
 * Its own module because both planes word this refusal -- the config
 * plane's `resolveSources` and the env plane's `fillEnv`, from
 * different packages -- and `errors.ts` is for the package's exception
 * types. Returns what follows "has" in the message: the labels for a
 * secret of ordinary size, a bare count for the process environment or
 * for anything big enough to be one.
 */
export declare function fieldSummary(fields: Readonly<Record<string, string>>, source: string): string;
/**
 * How a refusal names what a config schema rejected.
 *
 * The field path and the issue code per issue, and nothing else -- not
 * zod's rendered message, which a custom refinement is free to build
 * out of the input it refused. Every config this plane parses is one a
 * fetched credential may have just landed in: a source's own, a mount's,
 * an account CLI's. An unrecognized key carries no path, so its own
 * names stand in; they are what the deployment wrote in the block, not
 * anything fetched. Mirrors Python's `error_summary`, which has the
 * harder job: pydantic's rendering quotes the input outright.
 */
export declare function errorSummary(error: z.ZodError): string;
//# sourceMappingURL=summary.d.ts.map