// Force strict mode and setup for ESM
"use strict";
import {
  init_esbuild_shims
} from "./chunk-5O2XNYP6.js";

// packages/cli/src/config/shared-env-keys.ts
init_esbuild_shims();
var DEFAULT_EXCLUDED_ENV_VARS = ["DEBUG", "DEBUG_MODE"];
var ENV_CORRUPTED_PATH = "QWEN_CODE_SETTINGS_CORRUPTED_PATH";
var ENV_WAS_RECOVERED = "QWEN_CODE_SETTINGS_WAS_RECOVERED";
var PROJECT_ENV_HARDCODED_EXCLUSIONS = [
  "QWEN_HOME",
  "QWEN_RUNTIME_DIR",
  "QWEN_CODE_MCP_APPROVALS_PATH",
  "QWEN_CODE_TRUSTED_FOLDERS_PATH",
  ENV_CORRUPTED_PATH,
  ENV_WAS_RECOVERED,
  // QWEN_TLS_INSECURE (and NODE_TLS_REJECT_UNAUTHORIZED, which it mirrors)
  // disable TLS certificate verification for all outbound API connections. A
  // project `.env` must never enable either — that would let an untrusted repo
  // silently turn off MITM protection. Opt-in stays with the user via the
  // `--insecure` flag, the shell environment, or a home `.env`. The initial
  // `.env` load only consults this list, so both keys must be here (not just
  // RELOAD_EXCLUDED_KEYS, which only applies on reload).
  "QWEN_TLS_INSECURE",
  "NODE_TLS_REJECT_UNAUTHORIZED"
];
var HOME_ENV_BOOTSTRAP_KEYS = [
  "QWEN_HOME",
  "QWEN_RUNTIME_DIR",
  "QWEN_CODE_MCP_APPROVALS_PATH",
  "QWEN_CODE_TRUSTED_FOLDERS_PATH"
];

export {
  DEFAULT_EXCLUDED_ENV_VARS,
  ENV_CORRUPTED_PATH,
  ENV_WAS_RECOVERED,
  PROJECT_ENV_HARDCODED_EXCLUSIONS,
  HOME_ENV_BOOTSTRAP_KEYS
};
/**
 * @license
 * Copyright 2025 Qwen Team
 * SPDX-License-Identifier: Apache-2.0
 */
