/**
 * Build the forwarded environment for the headless `claude` child using a
 * STRICT exact-name allowlist (spec §14). We never forward ANTHROPIC_* by
 * prefix — that would silently leak ANTHROPIC_ADMIN_API_KEY, proxy overrides,
 * etc. into untrusted skill code. Anything not enumerated is dropped.
 */
export interface ForwardEnvOptions {
    /** True under --auth subscription (and inherit-with-subscription): drop the inference key so the child uses OAuth. */
    scrubInferenceKey: boolean;
    /** Additional exact model var names the run needs (e.g. ANTHROPIC_MODEL). */
    modelVars?: string[];
}
export declare function buildForwardedEnv(source: NodeJS.ProcessEnv, opts: ForwardEnvOptions): NodeJS.ProcessEnv;
/**
 * The full set of env var names protected from declared override. A declared
 * passEnv/injectEnv entry naming one of these is ignored (the protected value
 * wins) and a warning is surfaced — a test must never clobber PATH, the auth
 * credentials, or the admin key. `modelVars` (run-specific model env var names)
 * join the set so a declared var can't shadow them either.
 */
export declare function protectedEnvNames(modelVars?: readonly string[]): Set<string>;
/**
 * Returns true if `name` is in `protectedSet`.
 *
 * On Windows (win32) env names are case-insensitive — `path` and `PATH` are the
 * same variable — so we upper-case both sides before comparing. On POSIX, names
 * are genuinely case-distinct, so the comparison stays exact.
 *
 * The `platform` parameter defaults to `process.platform` but is exposed so
 * unit tests can exercise the win32 branch on any host OS.
 */
export declare function isProtectedName(name: string, protectedSet: Set<string>, platform?: string): boolean;
/** Declared test env (Features A + B) to union onto a forwarded env. */
export interface DeclaredEnvInput {
    /** Parent env to read Feature-A pass-through values from. */
    source: NodeJS.ProcessEnv;
    /** Feature A: names to forward from `source` if present. */
    passEnv?: readonly string[];
    /** Feature B: explicit key→value injections (already interpolated). */
    injectEnv?: Record<string, string>;
    /** Run-specific model env var names that are also protected. */
    modelVars?: readonly string[];
}
export interface DeclaredEnvResult {
    /** The forwarded env with declared additions unioned in. */
    env: NodeJS.ProcessEnv;
    /** Human-readable warnings (protected-key collisions). */
    warnings: string[];
    /** Names injected via Feature B (shown in the transparency line). */
    injected: string[];
    /** Names passed through via Feature A (redacted in the transparency line). */
    passedThrough: string[];
}
/**
 * Union declared test env (Features A + B) onto an already-built forwarded env.
 * Protected keys always win: a declared name colliding with a process-essential,
 * auth, model, or admin var is ignored and a warning emitted. Feature-B injection
 * (explicit value) takes precedence over Feature-A pass-through for the same key.
 * The input `base` object is never mutated.
 */
export declare function applyDeclaredEnv(base: NodeJS.ProcessEnv, input: DeclaredEnvInput): DeclaredEnvResult;
/**
 * Render the single-line stderr transparency summary of the forwarded env. Key
 * names are always shown. Auth/secret values are redacted; Feature-A pass-through
 * values are redacted (host-sourced, may be a secret); Feature-B injected values
 * are shown (they come from committed config).
 */
export declare function formatForwardedEnvLine(env: NodeJS.ProcessEnv, classified: {
    injected: readonly string[];
    passedThrough: readonly string[];
}): string;
//# sourceMappingURL=env-scrub.d.ts.map