import type { CleanedEnv, CleanOptions, Spec, ValidatorSpec } from 'envalid';
import { bool, EnvError, EnvMissingError, json, makeValidator, str, testOnly } from 'envalid';
import { type EnvCheck } from './checks';
/**
 * NODE_ENV resolved with "house" semantics.
 *
 * envalid natively treats an UNSET `NODE_ENV` as production, which means a
 * `devDefault` (fallback in dev, required in prod) throws in ordinary local
 * development where nobody sets `NODE_ENV`. That is the opposite of what we
 * want. `getNodeEnv` mirrors `@pgpmjs/env`'s `getNodeEnv`:
 *
 *   - explicit `production`                       -> `production`
 *   - explicit `test`/`testing`, or GitHub Actions -> `test`
 *   - anything else, INCLUDING UNSET              -> `development`
 */
export type NodeEnv = 'development' | 'production' | 'test';
export declare const getNodeEnv: (environment?: Record<string, string | undefined>) => NodeEnv;
export declare const isProduction: (environment?: Record<string, string | undefined>) => boolean;
export declare const isTest: (environment?: Record<string, string | undefined>) => boolean;
export declare const isDevelopment: (environment?: Record<string, string | undefined>) => boolean;
/**
 * Rollout valve for enforcing newly-reclassified env vars (class 2/3).
 *
 * When a var is promoted from "always has a baked default" to "must be provided
 * in production", a big-bang hard-throw can break every deploy that silently
 * relied on the old default. `STRICT_ENV` lets that enforcement roll out safely:
 *
 *   - `STRICT_ENV=throw`            -> hard-fail (throw) on a missing/unsafe value
 *   - anything else, INCLUDING UNSET -> `warn` (log loudly, keep booting)
 *
 * Defaulting to `warn` means enforcement surfaces in logs for a release before
 * it is turned into a hard failure. NOTE: this only governs opt-in enforcement
 * helpers (e.g. `assertProductionEnvOptions`); the `env()`/`cleanEnv` validators
 * always throw, so existing `required()`/`devDefault()` guarantees are unchanged.
 */
export type StrictEnvMode = 'warn' | 'throw';
export declare const getStrictEnvMode: (environment?: Record<string, string | undefined>) => StrictEnvMode;
export type EnvOptions<S> = CleanOptions<S> & {
    /** Constraints between vars, evaluated over the cleaned values. */
    checks?: readonly EnvCheck<never>[];
};
/**
 * Wrapper around envalid's cleanEnv that uses a throwing reporter by default
 * This prevents process.exit from being called on validation errors
 */
declare const cleanEnv: <S extends Record<string, ValidatorSpec<unknown>>>(environment: Record<string, string | undefined>, specs: S, options?: EnvOptions<S>) => CleanedEnv<S>;
type ValidatorFactory<T> = (spec?: Spec<T> | any) => ValidatorSpec<T>;
/** Class 1 — always resolves to `defaultValue` when the var is unset. */
declare const withDefault: <T>(validator: ValidatorFactory<T>, defaultValue: NonNullable<T>, spec?: Spec<T>) => ValidatorSpec<T>;
/** Class 2 — uses `defaultValue` in dev/test, but is required (throws) in production. */
declare const devDefault: <T>(validator: ValidatorFactory<T>, defaultValue: NonNullable<T>, spec?: Spec<T>) => ValidatorSpec<T>;
/** Class 3 — no fallback; throws in every environment when the var is absent. */
declare const required: <T>(validator: ValidatorFactory<T>, spec?: Spec<T>) => ValidatorSpec<T>;
/**
 * Parse a boolean env value leniently: `true`/`1`/`yes`/`on`/`t`/`y`
 * (case-insensitive) are true, an unrecognised spelling is false, and
 * unset/blank is `undefined`. Matches `@pgpmjs/env`'s `parseEnvBoolean`.
 */
declare const parseEnvBoolean: (val?: string) => boolean | undefined;
/** Parse a numeric env value; unset/blank/non-finite => undefined. */
declare const parseEnvNumber: (val?: string) => number | undefined;
/**
 * Parse a comma-separated env value into a trimmed, non-empty string list;
 * unset/blank => undefined.
 */
declare const parseEnvList: (val?: string) => string[] | undefined;
/**
 * Lenient boolean validator. Unlike envalid's built-in `bool` (which rejects
 * e.g. `TRUE`/`yes`), this accepts every spelling `asBoolean` knows
 * (`true`/`1`/`yes`/`on`/`t`/`y`) case-insensitively. Safe to
 * combine with a boolean `default`/`devDefault` (envalid also runs the validator
 * against the typed default).
 */
declare const boolish: import("envalid").BaseValidator<boolean>;
type Specs = Record<string, ValidatorSpec<unknown>>;
/**
 * Validate environment variables
 *
 * Everything declared in `secrets` is treated as sensitive: its value is never
 * printed in a validation error, and it is redacted from `JSON.stringify`/
 * `util.inspect` output of the returned object. Mark a var in `vars` the same
 * way with `str({ secret: true })`.
 *
 * @param inputEnv - The environment object (usually process.env)
 * @param secrets - Required environment variables (validated with envalid)
 * @param vars - Optional environment variables (validated with envalid)
 * @param options - `checks` for constraints between vars
 * @returns Validated and cleaned environment object
 *
 * @example
 * ```ts
 * const config = env(
 *   process.env,
 *   {
 *     DATABASE_URL: str(),
 *     API_KEY: str()
 *   },
 *   {
 *     PORT: port({ default: 3000 }),
 *     DEBUG: bool({ default: false })
 *   },
 *   {
 *     checks: [distinct(['CONTROL_USER', 'UPSTREAM_USER'])]
 *   }
 * );
 * ```
 */
declare const env: <S extends Specs, V extends Specs>(inputEnv: Record<string, string | undefined>, secrets?: S, vars?: V, options?: EnvOptions<S & V>) => CleanedEnv<S & V>;
export { bool, boolish, cleanEnv, devDefault, env, EnvError, EnvMissingError, json, makeValidator, parseEnvBoolean, parseEnvList, parseEnvNumber, required, str, testOnly, withDefault };
export { duration, type DurationSpec, email, enumerated, host, int, list, type ListSpec, num, type NumSpec, oneOf, port, url, uuid } from './validators';
export { distinct, type EnvCheck, mutuallyExclusive, requiredWhen, runChecks } from './checks';
export { redactEnvError, type SecretSpec } from './redact';
export type { CleanedEnv, Spec, ValidatorSpec };