/**
 * Trust boundary for network settings read out of `.openlore/config.json`.
 *
 * That file is committed IN the repository being analyzed, so on a cloned repo it is
 * attacker-authored — the same premise `safeOpenspecDir` already acts on for
 * `openspecPath`. Two of its fields decide where an OPERATOR credential goes and
 * whether the connection carrying it is verified:
 *
 *   - `llm.apiBase` — the provider endpoint. Anthropic requests carry the victim's
 *     `ANTHROPIC_API_KEY` in an `x-api-key` header, OpenAI's carry `OPENAI_API_KEY`
 *     as a bearer token. A repo that sets `apiBase` to a host it controls collects
 *     that key on the victim's next `openlore generate` / `drift` — or on their next
 *     commit, since the decisions gate runs consolidation from the pre-commit hook.
 *   - `llm.sslVerify: false` — turns off certificate verification, which is what
 *     makes the redirect survivable for an on-path attacker as well.
 *
 * The rule this module enforces: repo data may not choose where operator credentials
 * go, nor waive the verification protecting them. An operator can still do both — via
 * `--api-base` / `--insecure` or the provider env vars, all of which come from the
 * person running the command rather than from the clone.
 *
 * A loopback `apiBase` is exempt: pointing at a local proxy (ollama, LiteLLM, a
 * recording proxy) is the legitimate reason to commit the field at all, and a
 * loopback address cannot exfiltrate to an attacker's host.
 *
 * NOT covered here, deliberately: `generation.openaiCompatBaseUrl`. It has no default
 * — an openai-compat provider is unusable without it — so a committed value is the
 * documented way to configure a team's gateway, and refusing it would break working
 * repos. It gets a disclosure instead (see `command-helpers.ts`).
 */
/**
 * Resolve the effective `apiBase`, dropping a repo-supplied non-loopback endpoint.
 *
 * @param flagValue  `--api-base`, supplied by the operator on the command line.
 * @param configValue `llm.apiBase` from the repository's `.openlore/config.json`.
 * @returns the endpoint to use, or `undefined` for "the provider default".
 */
export declare function resolveTrustedApiBase(flagValue: string | undefined, configValue: string | undefined): string | undefined;
/**
 * Refuse a repo-configured endpoint outright when the caller has a safe fallback.
 *
 * The disclose-instead-of-refuse compromise elsewhere exists because those endpoints
 * have NO default — refusing would break the feature entirely. That reasoning does not
 * apply where a fallback exists: the embedding path degrades to the local BM25 keyword
 * index, which is the documented zero-config default anyway. So there the honest
 * answer is to refuse and say what happens instead, rather than warn and then ship the
 * repository's own source text to a host it chose.
 */
export declare function refuseRepoConfiguredEndpoint(field: string, url: string | undefined, fallbackDescription: string): string | undefined;
/**
 * Refuse a TLS opt-out that came from the repository's config, whatever spelling it
 * uses (`generation.skipSslVerify`, `embedding.skipSslVerify`). Always returns
 * `false` — "do not skip verification" — and says so once when the field was set.
 */
export declare function rejectRepoConfiguredTlsOptOut(field: string, value: boolean | undefined): boolean;
export declare function discloseRepoConfiguredEndpoint(field: string, url: string | undefined): void;
/**
 * Resolve TLS verification. `--insecure` decides when present; a repo-supplied
 * `sslVerify: false` is ignored, because a clone must not be able to turn off
 * certificate verification for the machine analyzing it.
 */
export declare function resolveTrustedSslVerify(flagInsecure: boolean | undefined, configSslVerify: boolean | undefined): boolean;
//# sourceMappingURL=repo-config-trust.d.ts.map