/**
 * The environment every cf child process receives (spec §F3).
 *
 * This is the only source file that names the Cloudflare API token variable;
 * everything else imports `CF_TOKEN_ENV` (enforced by the grep guard test).
 * The child environment is built from an empty object: a fixed allowlist is
 * copied by name without inspecting values, then fixed values are forced.
 * Base-URL overrides (`CLOUDFLARE_API_BASE_URL`, `CF_API_BASE_URL`), other
 * Cloudflare/Wrangler credentials, `VIGILBASE_*`, `NODE_OPTIONS`, `DEBUG`,
 * npm config and agent-harness markers are therefore absent by construction.
 * Scrubbing the base-URL variables is the primary control against redirecting
 * the token; the dry-run preflight cannot detect it.
 */
export declare const CF_TOKEN_ENV = "CLOUDFLARE_API_TOKEN";
export declare const CF_ACCOUNT_ENV = "CLOUDFLARE_ACCOUNT_ID";
export type CfAuthMode = 'profile' | 'env' | 'default';
/** `api`: authenticated reads; `offline`: --version and --dry-run; `login`: interactive `cf auth create` / `cf auth delete`. */
export type ChildEnvPurpose = 'api' | 'offline' | 'login';
/** Presence only: the value is never read, printed or validated by the Vigilbase CLI. */
export declare function hasEnvToken(parent: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
export declare function buildChildEnv(parent: NodeJS.ProcessEnv, options: {
    purpose: ChildEnvPurpose;
    authMode: CfAuthMode;
    accountId?: string;
    platform?: NodeJS.Platform;
}): Record<string, string>;
/** Variable names (never values) a cf child would receive, for `--dry-run` output. */
export declare function childEnvVariableNames(parent: NodeJS.ProcessEnv, authMode: CfAuthMode, platform?: NodeJS.Platform): string[];
/** Shown in profile and default modes when the token variable is set in the parent shell. */
export declare function strippedTokenNotice(authMode: CfAuthMode): string;
export declare function missingEnvTokenMessage(): string;