/**
 * Canonical publish-token store for the local Plans server.
 *
 * `agent-native connect <hosted-url>` mints a bearer token and writes it into
 * each coding agent's per-client MCP config (`.mcp.json` / Codex `config.toml`
 * via `mcp-config-writers`). Those files are client-specific, so the local Plans
 * server cannot read them for a server-to-server publish.
 *
 * To close that seam, the connect flow ALSO writes a single canonical record to
 * `~/.agent-native/plan-publish.json` whenever it authenticates a first-party
 * Plans app. The local server's `publish-visual-plan` action reads the exact
 * same file (see `templates/plan/server/lib/plan-publish.ts`):
 *
 *   { "url": "https://plan.agent-native.com", "token": "<bearer>" }
 *
 * This mirrors the existing device-token precedent in
 * `code-agent-connector.ts` (`~/.agent-native/remote-device.json`): home-dir
 * JSON, env-overridable path, atomic 0600 write. The write is additive — it
 * merges into any existing file rather than clobbering sibling keys — and
 * best-effort, since persisting MCP config is the primary contract and a failed
 * canonical write must never fail the connect.
 */
/**
 * Absolute path to the canonical publish-token file. Honors
 * `PLAN_PUBLISH_CONFIG_PATH` so connect and the local server agree on the
 * location in tests and custom setups; defaults to
 * `~/.agent-native/plan-publish.json`.
 */
export declare function planPublishConfigPath(): string;
/**
 * Whether `url`'s host is the first-party Agent-Native Plans app whose token
 * we should mirror to the canonical publish file. Only the hosted Plans app
 * (`plan.agent-native.com`) qualifies — mirroring tokens for other
 * agent-native subdomains (assets, mail, …) would silently overwrite the
 * canonical Plans endpoint with the wrong URL+token each time `connect --all`
 * runs last-write-wins. A custom self-hosted origin (ngrok, localhost, a
 * private deployment) is intentionally excluded: the user can still point the
 * server at it via `PLAN_PUBLISH_URL` / `PLAN_PUBLISH_TOKEN` env vars.
 */
export declare function isFirstPartyPlanHost(url: string): boolean;
/**
 * Merge `{ url, token }` into the canonical publish file without clobbering any
 * other keys the file already holds. Best-effort: returns the written path on
 * success, or `null` if the write failed or the inputs were unusable.
 *
 * `filePath` is injectable for tests; production callers omit it and get the
 * env-overridable home-dir path.
 */
export declare function writePlanPublishAuth(params: {
    url: string;
    token: string;
}, filePath?: string): string | null;
/**
 * Read the canonical Plans publish auth written by `agent-native connect`.
 * Returns `null` for missing/corrupt/incomplete files so callers can treat the
 * publish token as optional and guide the user to reconnect.
 */
export declare function readPlanPublishAuth(filePath?: string): {
    url: string;
    token: string;
} | null;
//# sourceMappingURL=plan-publish-store.d.ts.map