/**
 * Runtime config merge shared by every executor lane.
 *
 * Lives in its own side-effect-free module so the host can build the merged
 * config and hand it to the guest without importing the executor.
 */
/**
 * Merge the connector's runtime config with config-wins precedence for normal
 * keys, but force the gateway's authoritative security keys to win. Used at
 * every executor entry point so a tenant-controlled config cannot downgrade a
 * gateway-injected control (e.g. flipping block-private → allow-private).
 */
export declare function buildConnectorConfig(job: {
    env: Record<string, string | undefined>;
    config: Record<string, unknown>;
}): Record<string, unknown>;
//# sourceMappingURL=connector-config.d.ts.map