/**
 * Headless agent-native boundary definitions for @hasna/todos.
 * OSS stays local-first: CLI/MCP/SDK are primary; the optional local dashboard
 * may mutate via localhost API only — never hosted auth or hosted platform APIs.
 */
export declare const HEADLESS_BOUNDARY_VERSION = "todos.headless-boundary.v1";
export interface HeadlessBoundaryManifest {
    schema_version: typeof HEADLESS_BOUNDARY_VERSION;
    agent_native: true;
    hosted_auth: false;
    hosted_mutation: false;
    browser_mutations: "local_admin_only";
    primary_surfaces: ["cli", "mcp", "sdk"];
    optional_surfaces: ["local_dashboard"];
    local_api_only: true;
    forbidden_remote_hosts: string[];
    notes: string[];
}
export declare const FORBIDDEN_HOSTED_HOSTS: readonly ["todos.md", "www.todos.md", "preview.todos.md", "pay.hasna.tools", string];
export declare const FORBIDDEN_WEB_PATTERNS: Array<{
    name: string;
    pattern: RegExp;
}>;
/** Returns true when URL targets the local todos serve API (same machine). */
export declare function isAllowedLocalApiUrl(urlString: string, port?: number): boolean;
/** Throws if an outbound URL targets a forbidden hosted/platform surface. */
export declare function assertHeadlessOutboundUrl(urlString: string): void;
export declare function scanSourceForForbiddenWebPatterns(label: string, source: string): string[];
export declare function getHeadlessBoundaryManifest(): HeadlessBoundaryManifest;
//# sourceMappingURL=headless-boundaries.d.ts.map