import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
/** An installed package does not establish an active provider rewrite. */
export declare function canDeliverProtectedOutput(pi: ExtensionAPI, ctx: ExtensionContext): boolean;
export declare function registerProtectedOutputHost(pi: ExtensionAPI, available: (ctx: ExtensionContext) => boolean): () => void;
/** Credentials for the active transport only, never another registered model. */
export declare function resolveActiveCodexProvider(ctx: ExtensionContext): Promise<{
    baseUrl: string;
    accountId: string;
    headers: Headers;
}>;
export declare function protectedAccountScope(accountId: string): string;
/** Host session binding is independent of any extension's context-window policy. */
export declare function resolveProtectedOutputScope(ctx: ExtensionContext): Promise<string>;
/** Host-only proof; JSON/model arguments cannot authorise protected delivery. */
export declare function bindProtectedOutputScope(result: object, scope: string): void;
export declare function protectedOutputScope(result: unknown): string | undefined;
/** Also reads the old family-scoped encoding without retaining its execution engine. */
export declare function validateRemoteScope(encoded: unknown, account: () => string | undefined, ctx?: ExtensionContext, baseUrl?: string): void;
export declare function validateRemoteOutputReplay(messages: readonly unknown[], account: () => string | undefined, ctx?: ExtensionContext, baseUrl?: string): void;