/**
 * Keys the dashboard process reads from ~/.botmux/.env, beyond
 * {@link DAEMON_ENV_KEYS} (which is folded in below: every key baked into the
 * shared PM2 env block is by definition a setting the dashboard may resolve,
 * and a foreground/manual `dist/index-dashboard.js` has only the file).
 *
 * Each entry names its consumer inside the dashboard process, so a future
 * reader can verify — or delete — it:
 *  - SESSION_DATA_DIR → config.session.dataDir. The dashboard shares
 *    pairings/federations/memberships with the daemons under {dataDir}/*.json;
 *    a wrong value silently splits the store (cli.ts also bakes it).
 *  - CLI_ID / BACKEND_TYPE → config.daemon.cliId / config.daemon.backendType,
 *    the fleet-wide fallback the dashboard applies to a bot that pins neither
 *    (VC-meeting consumer isolation verdict, adapter capability probes).
 *  - BOTMUX_SCHEDULE_TIMEZONE → utils/timezone scheduleTimeZone(). The settings
 *    payload advertises `effectiveScheduleTimeZone`; dropping the env override
 *    here would make the UI report a zone the daemons do not fire in.
 *  - FEISHU_USER_ACCESS_TOKEN → utils/user-token resolveUserToken(), used by
 *    dashboard/feed-groups.ts. A credential, kept for the same reason as the H5
 *    APP_SECRET below: the dashboard is a real consumer. Not a licence to add
 *    other credentials — a key belongs here only with a named consumer.
 *  - BOTMUX_DASHBOARD_DEV_RELOAD → dashboard.ts dev-reload switch.
 *  - proxy family → outbound HTTPS from the dashboard itself (npm registry
 *    version/rollback lookups, hd2d asset download) on hosts without direct
 *    internet. These are forwarded to CLI children by design elsewhere
 *    (PROXY_ENV_KEYS), so allowing them adds no new exposure.
 */
export declare const DASHBOARD_ENV_ALLOWLIST: readonly ["WEB_EXTERNAL_HOST", "BOTMUX_DASHBOARD_EXTERNAL_HOST", "BOTMUX_DASHBOARD_HOST", "BOTMUX_DASHBOARD_PORT", "BOTMUX_DAEMON_IPC_BASE_PORT", "BOTMUX_DASHBOARD_PUBLIC_READONLY", "BOTMUX_PUBLIC_URL", "BOTMUX_DASHBOARD_CONTROL_AUDIT_PATH", "BOTMUX_DASHBOARD_TERMINAL_CONTROL_TTL_MS", "SESSION_DATA_DIR", "CLI_ID", "BACKEND_TYPE", "BOTMUX_SCHEDULE_TIMEZONE", "FEISHU_USER_ACCESS_TOKEN", "BOTMUX_DASHBOARD_DEV_RELOAD", "http_proxy", "https_proxy", "HTTP_PROXY", "HTTPS_PROXY", "no_proxy", "NO_PROXY", "all_proxy", "ALL_PROXY"];
/**
 * True for a key the dashboard may take from ~/.botmux/.env.
 *
 * The Feishu H5 login family is matched by PREFIX, not by name: the dashboard
 * is that family's single consumer (resolveDashboardH5AuthConfig), and a knob
 * added tomorrow must work the day it ships — the same prefix rule
 * stripDashboardH5Env() uses to remove it everywhere else, so the two cannot
 * drift into "loaded here, not stripped there".
 */
export declare function isDashboardEnvKey(key: string): boolean;
/**
 * Load `envPath` and merge ONLY {@link isDashboardEnvKey} keys into `target`
 * (default process.env).
 *
 * Semantics kept identical to the previous wholesale `dotenvConfig({ path })`
 * for allowlisted keys — a value already present in `target` wins, so the
 * deterministic PM2 snapshot (resolveDaemonEnv → DAEMON_ENV_KEYS) still
 * outranks the file. The difference is everything else in the file: it is
 * parsed into a private object and dropped.
 *
 * A missing/unreadable file is a no-op (dotenv reports it in `result.error`;
 * the dashboard has always treated an absent .env as "no settings").
 */
export declare function loadDashboardEnvFile(envPath: string, target?: NodeJS.ProcessEnv): void;
//# sourceMappingURL=dashboard-env.d.ts.map