export declare const ENV_FILE: string;
/**
 * Defense-in-depth against the v1.0.14 class of incident: a `bun test` run
 * on a box that doubles as the agim host silently clobbering the operator's
 * real ~/.agim/env — observed as `AGIM_ADMIN_USERS=telegram:123` (the
 * admin-bootstrap test fixture) overwriting the real admin list and locking
 * the operator out of every admin command.
 *
 * The test preload (test/setup.ts, wired via bunfig.toml) sandboxes
 * AGIM_HOME to a tmpdir so these writes land harmlessly. But that preload is
 * a single point of failure: if it doesn't run (a stray `bun test <file>`
 * from the wrong cwd, a `--preload` override, a future/other runner), the
 * sandbox evaporates and writes hit the live file again.
 *
 * bun / vitest / jest all set NODE_ENV=test intrinsically (verified: bun
 * 1.3 sets it even without the preload). So we gate on that signal —
 * independent of the preload — and refuse any env-file mutation whose target
 * is outside the OS tmpdir while under test. A botched test run now throws
 * loudly instead of silently wiping the operator's config. Production never
 * sets NODE_ENV=test, so this is a no-op there.
 *
 * Exported for the regression test in test/unit/env-file-guard.test.ts.
 */
export declare function assertEnvWriteAllowed(target?: string): void;
/** Read existing env as a plain Record. Unknown lines (blank / comment)
 *  are dropped from the returned map but PRESERVED on write via merge. */
export declare function readEnvFile(): Record<string, string>;
/** Parse `Environment="KEY=value"` and `Environment=KEY=value` lines out
 *  of the agim systemd unit. Used as a fallback for `readEffectiveEnv()`
 *  on machines where the wizard hasn't yet written to ~/.agim/env AND
 *  the user's interactive shell doesn't export the keys — the unit file
 *  is world-readable on standard installs, so this works for `agim
 *  config` invoked as the user. Returns {} if the file is missing/unreadable. */
export declare function readSystemdUnitEnv(): Record<string, string>;
/** Read priority:
 *    1. ~/.agim/env  (canonical, what the wizard writes)
 *    2. process.env     (current shell / inherited)
 *    3. systemd unit's Environment= lines (what's actually in effect for
 *       the running service when the wizard is invoked from a shell that
 *       doesn't export the keys — most common case after a manual install)
 *
 *  Writes still go to the env file only — see `updateEnvFile()`. Callers
 *  that need to warn about shadowing should use `hasProcessEnvOverride()`. */
export declare function readEffectiveEnv(): Record<string, string>;
/** True when a wizard-managed key is set in the running env (process.env
 *  or systemd unit) but NOT in the env file — i.e. the wizard's writes
 *  won't be the source of truth at runtime. Used to print a warning at
 *  SMTP/Baidu save. */
export declare function hasProcessEnvOverride(key: string): boolean;
/** Merge-update: keep existing keys, overwrite the supplied ones, REMOVE
 *  any keys whose value in `updates` is explicitly null/undefined. Writes
 *  the file with chmod 600. */
export declare function updateEnvFile(updates: Record<string, string | null | undefined>): void;
/** Wipe a single key. No-op if missing. */
export declare function unsetEnvKey(key: string): void;
/** Remove the env file entirely. Used by `uninstall`. */
export declare function removeEnvFile(): void;
//# sourceMappingURL=env-file.d.ts.map