/**
 * .env file and secret-status utilities.
 *
 * Shared between the remote server (tool handlers) and callboard (local mode).
 * All functions use getEnvFilePath() from shared/config for path resolution.
 */
import { type RemoteServerConfig } from './config.js';
/** Convert caller alias to env var prefix: "default" → "DEFAULT", "my-agent" → "MY_AGENT" */
export declare function callerToPrefix(callerAlias: string): string;
/** Get prefixed env var name: ("default", "GITHUB_TOKEN") → "DEFAULT_GITHUB_TOKEN" */
export declare function prefixedEnvVar(callerAlias: string, secretName: string): string;
/** Load all vars from the .env file into a map (does NOT set process.env). */
export declare function loadEnvFile(): Record<string, string>;
/** Load .env file into process.env (for startup). */
export declare function loadEnvIntoProcess(): void;
/**
 * Write key-value pairs to .env. Empty string = delete.
 * Also sets process.env immediately for in-process use.
 */
export declare function setEnvVars(updates: Record<string, string>): void;
/**
 * Check if a secret is set for a caller.
 * Resolution: caller env mapping → prefixed env var.
 * Bare env var fallback intentionally removed to prevent cross-caller leakage.
 */
export declare function isSecretSetForCaller(secretName: string, callerAlias: string, callerEnv?: Record<string, string>): boolean;
/**
 * Regex for valid secret names: uppercase letters, digits, and underscores;
 * must start with a letter. Prevents injection of system env vars
 * (e.g., PATH, NODE_OPTIONS, LD_PRELOAD).
 */
export declare const SECRET_NAME_REGEX: RegExp;
/**
 * Set secrets for a caller with prefixed env vars.
 * Updates .env file, process.env, and caller's env mapping in config.
 * Returns boolean status per secret name.
 */
export declare function setCallerSecrets(secrets: Record<string, string>, callerAlias: string, config: RemoteServerConfig): {
    config: RemoteServerConfig;
    status: Record<string, boolean>;
};
//# sourceMappingURL=env-utils.d.ts.map