/**
 * Connector-runtime env whitelist.
 *
 * A connector run receives `context.env`, which the prelude installs as
 * `process.env` inside the isolate guest.
 * The standalone `connector-worker` CLI builds this set deliberately so
 * connectors only see the env vars they actually need (GitHub token,
 * provider API keys, etc.) — never the host process's secrets.
 *
 * Used by both the standalone CLI (`bin.ts`) and the in-process embedded
 * worker (`packages/server/src/scheduled/embedded-connector-worker.ts`).
 * Lives in its own module so the embedded worker can import the helper
 * without pulling in `bin.ts`'s top-level `main()` call (which would
 * print CLI usage and `process.exit` on startup).
 */
import type { Env } from '@lobu/connector-sdk';
/**
 * Deployment-level provider credentials: the operator's own GitHub / Reddit /
 * Maps apps. They reach connector code the operator SHIPS — the image's
 * bundled connectors — and never code an organization uploaded. On a shared
 * fleet worker the isolate is the only boundary between a tenant's connector
 * and this env, so `withoutDeploymentProviderKeys` is what that boundary
 * withholds; the decision is made per RUN, on provenance, because a worker
 * often has no `LOBU_CLOUD_MODE` of its own (prod's fleet worker learns
 * block-private from the gateway's poll response, not from its env).
 */
export declare const DEPLOYMENT_PROVIDER_ENV_KEYS: readonly ["GITHUB_TOKEN", "GOOGLE_MAPS_API_KEY", "REDDIT_CLIENT_ID", "REDDIT_CLIENT_SECRET"];
export declare function withoutDeploymentProviderKeys(env: Env): Env;
/**
 * The env for one connector run executed IN the gateway process (inline
 * actions, webhook registration). Same whitelist a fleet worker gets — never
 * `process.env`, which would hand ENCRYPTION_KEY, DATABASE_URL and
 * WORKER_API_TOKEN to whatever code the run executes — and, under Cloud,
 * without the deployment provider keys when the code is organization-supplied.
 */
export declare function connectorRunEnv(opts: {
    organizationSupplied: boolean;
    cloud: boolean;
}): Record<string, string | undefined>;
export declare function buildConnectorWorkerEnv(): Env;
//# sourceMappingURL=env.d.ts.map