/**
 * Routing classification + client-id safety, in a leaf module imported by
 * BOTH cli-agents.ts and the claude adapter. Living here (rather than in
 * cli-agents.ts) breaks the cli-agents → cli-adapters → cli-agents value cycle:
 * the only back-reference is a type-only import of CLIClientSpec, which is
 * erased at runtime.
 */
import type { CLIClientSpec } from '../cli-agents.js';
/** Native CLI provider names. A CUSTOM client may not claim one as its id. */
export declare const NATIVE_CLI_IDS: readonly ["claude", "codex", "agy"];
/**
 * Custom-endpoint routing fields that are only meaningful for the claude
 * provider (the claude binary is the only Anthropic-API gateway client).
 * Used to fail-fast (schema) / warn-and-strip (env) for codex/agy clients.
 */
export declare const ROUTING_FIELDS: readonly ["model", "smallFastModel", "baseUrl", "authToken", "authTokenEnv", "configDir", "env", "includeProcessAuth", "containment"];
/**
 * Is a SANITIZED id unsafe for a custom client? Two failure modes:
 *  - it collides with a native CLI name (claude/codex/agy) → attribution
 *    corruption: a routed client and the native critic share one identity in
 *    the clientId??cli keying, so one silently suppresses the other.
 *  - it is a path-traversal basename ('.' / '..') → escapes the per-client
 *    `~/.brutalist/claude-clients/<id>` leaf (`..` → the parent dir, `.` → the
 *    shared dir), breaking the isolated-0700-per-client contract.
 * ('/' is not in the sanitize alphabet — it becomes '-' — so '.' and '..' are
 * the only reachable traversal values.)
 */
export declare function isReservedCustomClientId(sanitizedId: string): boolean;
/**
 * Routing classification for a Claude-provider client. A client is "routed"
 * — pointed at a custom Anthropic-compatible endpoint such as a GLM gateway
 * — when it carries ANY routing signal: a base URL (typed field or via
 * env.ANTHROPIC_BASE_URL), a bearer token, or an explicit opt-out of
 * process-auth inheritance. Routed clients are isolated-by-default (no
 * native credential inheritance) and suppress caller-requested MCP by default.
 * Built-in Bash and web tools remain available. Everything else is "native";
 * the same routing predicate selects both credential and MCP policy.
 */
export declare function classifyRouting(c?: CLIClientSpec): 'native' | 'routed';
export declare function isRoutedClient(c?: CLIClientSpec): boolean;
//# sourceMappingURL=routing.d.ts.map