import { type HostProfileControllerScopeV1, type HostProfileRegistry, type HostProfileV1 } from "./host-profile.js";
import { type CallbackRouteV1 } from "./callback-transport.js";
export declare const AKK_HOST_PROFILE_SELECTION: "AKK_HOST_PROFILE_SELECTION";
export declare const AKK_HOST_PROFILE_SOURCE: "AKK_HOST_PROFILE_SOURCE";
export declare const AKK_HOST_PROFILE_FINGERPRINT: "AKK_HOST_PROFILE_FINGERPRINT";
export declare const AKK_HOST_PROFILE_HOST: "AKK_HOST_PROFILE_HOST";
export declare const AKK_HOST_PROFILE_HOST_VERSION: "AKK_HOST_PROFILE_HOST_VERSION";
export declare const defaultHostProfileRegistry: HostProfileRegistry;
export interface SelectedHostProfileV1 {
    readonly source: "built_in" | "file";
    readonly selection: string;
    readonly fingerprint: string;
    readonly profile: HostProfileV1;
}
export interface TrustedHostProfileRuntimeV1 {
    readonly selected: SelectedHostProfileV1;
    readonly controllerScope: HostProfileControllerScopeV1;
    readonly controllerSessionId: string;
    readonly host: string;
    readonly hostVersion: string;
    readonly callbackRoute: CallbackRouteV1;
}
export interface SelectHostProfileOptions {
    readonly cwd?: string;
    readonly registry?: HostProfileRegistry;
}
export interface CreateTrustedHostProfileRuntimeOptions extends SelectHostProfileOptions {
    readonly selection: string;
    readonly host: string;
    readonly hostVersion: string;
    readonly environment: Readonly<Record<string, string | undefined>>;
}
/**
 * Resolve one startup-selected Profile. A registry id wins over filesystem
 * interpretation so an explicit user file cannot shadow a bundled Profile.
 */
export declare function selectHostProfileV1(selection: string, options?: SelectHostProfileOptions): SelectedHostProfileV1;
/** Capture all authority needed by a Host-launched Bridge at startup. */
export declare function createTrustedHostProfileRuntime(options: CreateTrustedHostProfileRuntimeOptions): TrustedHostProfileRuntimeV1;
/**
 * Build the private child-process environment used by the Bridge. The exact
 * Profile fingerprint and route-creation controller identity are captured
 * once; model-facing tool arguments have no route/profile fields and cannot
 * override them. A route-bound callback later uses only that persisted route.
 */
export declare function hostProfileRelayEnvironment(runtime: TrustedHostProfileRuntimeV1, baseEnvironment: Readonly<NodeJS.ProcessEnv>): NodeJS.ProcessEnv;
/**
 * Re-resolve trusted Bridge authority inside a CLI/monitor child. User Profile
 * edits after Bridge startup fail closed unless their complete fingerprint is
 * unchanged.
 */
export declare function trustedHostProfileRuntimeFromEnvironment(environment: Readonly<NodeJS.ProcessEnv>, options?: SelectHostProfileOptions): TrustedHostProfileRuntimeV1 | undefined;
/** Add only trusted in-process route fields needed by new Turn/Watch creation. */
export declare function applyTrustedHostProfileCliOptions(commandName: string | undefined, options: Readonly<Record<string, unknown>>, environment: Readonly<NodeJS.ProcessEnv>, cwd: string): Record<string, unknown>;
export declare function callbackRouteForHostProfile(profile: HostProfileV1, controllerSessionId: string): CallbackRouteV1;