import type { RemoteToolSource } from "../tool/types.js";
/**
 * Operator-owned grant for resolving and using local integration credentials.
 *
 * The host environment accessor bypasses project environment overlays, so a
 * tenant cannot grant this capability. The exact value `1` keeps the opt-in
 * deliberate and makes absent or malformed configuration fail closed.
 */
export declare const HOST_LOCAL_INTEGRATION_CREDENTIALS_ENV = "VERYFRONT_HOST_ALLOW_LOCAL_INTEGRATION_CREDENTIALS";
export declare function isHostLocalIntegrationCredentialsEnabled(value?: string | undefined): boolean;
/**
 * Refuse local credential discovery and execution unless the host granted it.
 *
 * A proxy runtime is refused even when the grant is set, because it never owns
 * the credentials it would forward.
 */
export declare function assertLocalCredentialHostGrant(): void;
/** @internal Apply the host grant to both operations of a local credential source. */
export declare function guardLocalCredentialSource(source: RemoteToolSource): RemoteToolSource;
//# sourceMappingURL=local-credential-host-policy.d.ts.map