/**
 * Fetches project environment variables from the Veryfront API.
 *
 * @module server/project-env/fetcher
 */
/** Hard ceiling for the complete JSON envelope returned by the env API. */
export declare const PROJECT_ENV_RESPONSE_MAX_BYTES: number;
declare function fetchEnvironmentVariables(url: string, authorization: string, projectSlug: string, environmentId: string, signal?: AbortSignal, headers?: HeadersInit): Promise<Response>;
/**
 * Fetch environment variables for a project from the Veryfront API.
 *
 * The caller's project credential is always checked against the project-scoped
 * management endpoint before host-level internal credentials may retrieve secret
 * values. This prevents a tenant-controlled environment ID from turning the
 * runtime's internal credentials into a cross-project confused deputy.
 *
 * Deployments that configure internal credentials must expose the internal
 * endpoint. There is intentionally no fallback after that privileged path fails.
 * Response: { data: [{ key: string, value: string }] }
 */
export declare function fetchProjectEnvVars(apiBaseUrl: string, projectSlug: string, environmentId: string, token: string, signal?: AbortSignal): Promise<Record<string, string>>;
/**
 * Test-only access to the privileged fetch helper. Never import this outside
 * `fetcher.test.ts`.
 *
 * The header-authority regression it guards (authoritative `Authorization`/
 * `Accept` must be set after merging optional caller headers) is unobservable
 * through `fetchProjectEnvVars`: the public path only ever passes a benign
 * `x-project-slug` header, so a reintroduced spread-order bug would not change
 * the public function's behavior in a test.
 *
 * @internal
 */
export declare const projectEnvFetcherInternals: {
    readonly fetchEnvironmentVariables: typeof fetchEnvironmentVariables;
};
export {};
//# sourceMappingURL=fetcher.d.ts.map