/** OpenAI's own Codex plugin marketplaces, by their exact native names in Codex
 * 0.162.1. Only these hold vendor plugin copies; every other marketplace,
 * including Hasna's and look-alike names, is never treated as vendor content. */
export declare const CODEX_VENDOR_MARKETPLACES: readonly string[];
/** Vendor marketplaces whose plugins Codex installs remotely and records with a
 * `.codex-remote-plugin-install.json` receipt beside their versions. */
export declare const CODEX_REMOTE_VENDOR_MARKETPLACES: readonly string[];
/** The allowlisted vendor marketplace a canonical path lies in, at or below
 * `<cache>/<marketplace>`, or null for the cache itself, other marketplaces and
 * any non-canonical path. */
export declare function codexVendorMarketplace(cache: string, path: string): string | null;
/** A plugin version root a vendor refresh can add without review: its only
 * manifest is a regular `.codex-plugin/plugin.json` (alone in its directory,
 * no duplicate keys) whose keys are all in VENDOR_MANIFEST_KEYS, with the
 * default skills root and, when present, exactly the `./.app.json` connector
 * declaration backed by an `.app.json` that passes the strict connector
 * validation rootControls applies (codexAppDeclarationValid); there is no hooks, MCP, command
 * or agent location and no root, Claude or Cursor manifest; every skill in it
 * is visible to the native inventory. Errors and bounds refuse. */
export declare function codexVendorPluginRootRefreshSafe(root: string, budget?: {
    remaining: number;
}): boolean;
/** True only when every cached version of one vendor plugin
 * (`<cache>/<marketplace>/<plugin>`) passes codexVendorPluginRootRefreshSafe,
 * the plugin directory carries no manifest, hooks, MCP, command or agent
 * location of its own, and no version is a link. Errors and bounds refuse. */
export declare function codexVendorPluginRefreshSafe(parent: string, budget?: {
    remaining: number;
}): boolean;
/** True only when every plugin in a vendor marketplace subtree could have been
 * added by a routine vendor refresh: each plugin passes
 * codexVendorPluginRefreshSafe and the marketplace holds no link, special file
 * or hidden directory. Plugin hooks and other skill roots need their own
 * review, so a membership change that adds them is never a routine vendor
 * refresh. The whole marketplace is checked, not only new versions, so anything
 * unexpected anywhere refuses. Bounded; links are never followed; errors refuse. */
export declare function codexVendorSubtreeHookFree(cache: string, path: string): boolean;
/** Candidate earlier versions of a Codex config.toml that differ from `text`
 * only by appended vendor disable rows and/or vendor plugin disables,
 * the entries an operator or Codex adds when a vendor plugin refreshes. Each
 * candidate is checked to parse to exactly `text` without those entries, so a
 * candidate whose digest equals the reviewed witness proves the change is
 * vendor-only. Anything the text model cannot remove exactly yields no
 * candidate, which keeps the witness strict.
 *
 * Bounds: at most 8 vendor plugin tables, 16 trailing rows and 128 candidates,
 * tried smallest edit first (fewest changed tables, then fewest removed rows).
 * `rowsAffectDigest: false` (a typed V2-V5 witness, which ignores disable-only
 * rows) skips row removal; with it, every change to at most two of eight
 * tables fits the 128 candidates. Otherwise appended rows alone always fit.
 * A bound only ever omits candidates, so it can only cause a refusal. */
export declare function codexVendorConfigCandidates(text: string, cache: string, options?: {
    rowsAffectDigest?: boolean;
}): string[];