/** @public */
export type SubprocessEnvInput = Record<string, string | undefined>;
export declare const INTERNAL_REPOSITORY_GIT_SSH_ENV_PREFIX = "LEITWERK_INTERNAL_REPOSITORY_GIT_SSH_";
export declare const INTERNAL_REPOSITORY_GIT_HTTPS_ENV_PREFIX = "LEITWERK_INTERNAL_REPOSITORY_GIT_HTTPS_";
/** @internal */
export declare const WORKER_SUBPROCESS_SENSITIVE_ENV_KEYS: readonly ["LEITWERK_WORKER_CONNECT_TOKEN", "LEITWERK_WORKER_RECONNECT", "LEITWERK_WORKER_SNAPSHOT_TOKEN"];
/**
 * Builds an environment for worker-executed repository shell/tool commands.
 *
 * Worker IPC and session-snapshot credentials are valid only for the worker
 * process itself. Repository scripts, git hooks, package managers, and other
 * tool subprocesses must not receive them.
 */
/** @public */
export declare function sanitizeWorkerSubprocessEnv(baseEnv?: SubprocessEnvInput, overrides?: SubprocessEnvInput): NodeJS.ProcessEnv;
//# sourceMappingURL=subprocess-env.d.ts.map