/**
 * System and reserved environment variables that cannot be forwarded to the
 * container. Forwarding these could shadow critical system behavior or conflict
 * with server/sandbox internals.
 */
export declare const RESERVED_ENV_VARS: Set<string>;
/**
 * Name families owned by the platform; user variables must not enter them.
 * Mirrors `RESERVED_ENV_PREFIXES` in `packages/shared/src/reserved-env-vars.ts`
 * (the server's source of truth — keep the two lists in sync). The server
 * rejects a launch with HTTP 400 when a forwarded name matches one of these,
 * so the CLI must filter them out of `envVars: "all"` and refuse them in an
 * explicit list, exactly as it does for the exact names above.
 */
export declare const RESERVED_ENV_PREFIXES: readonly string[];
/** True when `name` is reserved by exact name or by a reserved prefix. */
export declare function isReservedEnvVar(name: string): boolean;
/** The subset of `names` that may be forwarded (not reserved by name or prefix). */
export declare function filterReservedEnvVars(names: string[]): string[];
/**
 * Validate that none of the requested env vars are reserved (by exact name or
 * by a reserved prefix). Throws an error with a friendly message if any are
 * found, naming the prefix rule for prefix matches.
 */
export declare function validateNoReservedVars(requestedVars: string[]): void;
/**
 * Read and filter the project's .env file to only include the requested
 * variables. Reads the file directly (via dotenv's `parse`) rather than relying
 * on `process.env`, so values are sourced from the project's .env regardless of
 * the ambient environment.
 *
 * Throws if the .env file doesn't exist or if any requested variable is missing.
 * Returns an object of { varName: value } pairs.
 */
export declare function readAndFilterEnvVars(projectRoot: string, requestedVars: string[]): {
    [key: string]: string;
};
//# sourceMappingURL=env-vars.d.ts.map