/**
 * Resolve the effective, TRUSTED relay base URL from a raw candidate (typically
 * `process.env.AICOMMANDER_SERVER`). Returns a URL string safe to register and
 * open a root-exec socket against. Never throws — an unparseable or untrusted
 * value falls back to DEFAULT_SERVER (with a loud warning) rather than crashing.
 */
export declare function resolveTrustedServerUrl(raw?: string | null): string;
/**
 * Assert the about-to-open agent WebSocket URL is encrypted (wss://) or an explicit
 * loopback dev target (ws://localhost). Belt-and-suspenders on top of
 * resolveTrustedServerUrl, evaluated at the actual connection point. Throws on a
 * plaintext non-loopback URL so a root agent never opens an unauthenticated link.
 */
export declare function assertSecureWsUrl(wsUrl: string): void;