import type { CredentialProfile, CredentialProfileStatus } from "@claudexor/schema";
import { type ClaudeProfileRuntimeDeps } from "./index.js";
/**
 * Canonicalize a profile's isolation locator (INV-135): absolute, trailing
 * separators stripped, symlinks resolved when the dir exists. Under the
 * unified account model the Claudexor-owned legacy native dir IS a legal row
 * locator — the exact dir the startup migration auto-registers as
 * `claude-default` (bytes never move; Claude Code keys its Keychain item by
 * this exact path). Ordinary ~/.claude stays outside the owned root and is
 * still refused by the shared isolation-locator authority check.
 */
export declare function canonicalProfileConfigDir(locator: string): string;
/**
 * INV-135 strict profile routing for a run: exactly the profile's transport
 * or a typed refusal — never the default ladder, never a cross-profile
 * fallback. Pure resolution; the caller yields the refusal into the stream.
 */
export declare function resolveClaudeProfileRoute(profile: CredentialProfile, specEnv: Record<string, string>, runtime: ClaudeProfileRuntimeDeps, abortSignal?: AbortSignal): Promise<{
    route: "subscription" | "api_key";
    nativeEnv: Record<string, string | null | undefined>;
    subscriptionSource: "native_session" | "oauth_token_env" | null;
    key: string | null;
    oauthToken: string | null;
    authStatusStale?: boolean;
    authStatusStaleAgeMs?: number;
    refusal: null;
} | {
    refusal: string;
}>;
/** Doctor projection for one claude profile (INV-135). */
export declare function probeClaudeCredentialProfile(profile: CredentialProfile, runtime: ClaudeProfileRuntimeDeps, abortSignal?: AbortSignal): Promise<CredentialProfileStatus>;
//# sourceMappingURL=profile.d.ts.map