export type ChildEnvSource = Readonly<Record<string, string | undefined>>;
export declare const DEFAULT_CHILD_ENV_ALLOWLIST: readonly string[];
export interface ChildEnvOptions {
    readonly parentEnv?: ChildEnvSource;
    readonly overrideEnv?: ChildEnvSource;
    readonly inheritParentEnv?: boolean;
    readonly allowedParentEnvNames?: readonly string[];
    readonly allowedSecretEnvNames?: readonly string[];
    readonly allowSecretPassthrough?: boolean;
}
export interface ChildEnvAuditMetadata {
    readonly grantedSecretEnvNames: readonly string[];
    readonly deniedSecretEnvNames: readonly string[];
    readonly deniedChildEnvNames: readonly string[];
}
export interface ChildEnvBuildResult {
    readonly env: Record<string, string>;
    readonly metadata: ChildEnvAuditMetadata;
}
export interface RuntimeChildEnvMetadata {
    readonly runtimeId?: string;
    readonly runId?: string;
    readonly nodeId?: string;
    readonly role?: string;
    readonly goal?: string;
}
export declare function isSecretLikeEnvName(name: string): boolean;
export declare function isDeniedChildEnvName(name: string): boolean;
export declare function buildChildEnvWithMetadata(options?: ChildEnvOptions): ChildEnvBuildResult;
export declare function buildChildEnv(options?: ChildEnvOptions): Record<string, string>;
export declare function runtimeMetadataEnv(metadata: RuntimeChildEnvMetadata): Record<string, string>;
