import { splitUserHost, type MatchHostOptions } from '../hosts/registry.js';
import { type DeviceProfile } from './registry.js';
export { splitUserHost };
/** A dialable peer: the ssh target, the machine id used to tag its rows, a
 * display name, and the OS family that picks the remote shell dialect. */
export interface ResolvedSshTarget {
    target: string;
    machine: string;
    name: string;
    os?: string;
    extraSshArgs?: string[];
}
export interface ResolvedExplicitTargetSet {
    targets: ResolvedSshTarget[];
    unresolved: string[];
}
/**
 * Resolve a target token to a full {@link DeviceProfile} for `agents ssh`. Same
 * grammar as the fan-out, but returns the whole profile (auth, shell, tailscale
 * metadata) `buildSshInvocation` needs. A registered `name` / `user@device`
 * yields that profile (login user overridden by any `user@`); an ad-hoc
 * `user@host` / IP / FQDN literal yields a synthesized key-auth profile. A bare
 * unregistered alias (no `@`/dot) — or an ssh_config-only alias, which `agents
 * ssh` has never dialed — returns undefined so the caller reports "Unknown
 * device" rather than dialing a literal. `token` may also be the `auto`
 * affinity sentinel (RUSH-2185); `opts.resolveAuto` overrides the pick (tests).
 */
export declare function resolveDeviceTarget(token: string, opts?: Pick<MatchHostOptions, 'resolveAuto'>): Promise<DeviceProfile | undefined>;
/**
 * Resolve an explicit `--device`/`--device` list to dialable targets. A token that
 * fails the injection guard or names nothing reachable is skipped with a stderr
 * note (never fatal — one bad token must not blank the fan-out). Shared by every
 * cross-machine fan-out so they can never diverge onto two routes.
 */
export declare function resolveExplicitTargets(hosts: string[]): Promise<ResolvedSshTarget[]>;
/** Resolve explicit tokens while retaining failures for coverage-sensitive callers. */
export declare function resolveExplicitTargetSet(hosts: string[]): Promise<ResolvedExplicitTargetSet>;
