/**
 * Custom-harness profile helpers (shared by `agents harness`).
 *
 * Named bundles of (host CLI, endpoint, model, keychain auth) live under
 * ~/.agents/profiles/*.yml. The user-facing surface is `agents harness`
 * (add/fork/edit/list/view/remove). This module keeps the shared write helpers
 * (`addProfile`, `ensureProviderToken`, …) that harness and the run path use.
 */
import { type Profile } from '../lib/profiles.js';
import { type Preset } from '../lib/profiles-presets.js';
/**
 * Pure helper: builds a Profile from collected wizard inputs. Extracted so the
 * shape of preset->profile mapping for the `create` wizard is unit-testable
 * without mocking @inquirer/prompts.
 */
export declare function buildProfileFromCollection(name: string, preset: Preset, collected: Record<string, string>, version?: string): Profile;
/** Read all available data from stdin synchronously, trimmed. */
/** Ensure a provider API key exists in keychain, prompting or reading stdin if missing. */
export declare function ensureProviderToken(provider: string, signupUrl?: string, fromStdin?: boolean): Promise<void>;
/** Options accepted by {@link addProfile} — shared by `agents harness add` and `agents harness add`. */
export interface AddProfileOptions {
    preset?: string;
    host?: string;
    model?: string;
    baseUrl?: string;
    authProvider?: string;
    account?: string;
    version?: string;
    keyStdin?: boolean;
    force?: boolean;
    /** `<bundle>` or `<bundle>:<key>` — see {@link applyFromSecrets}. */
    fromSecrets?: string;
}
/**
 * Copy a value from an `agents secrets` bundle into a profile's own keychain
 * item — a one-time copy, not a live link. `spec` is `<bundle>` or
 * `<bundle>:<key>`; the key is required only when the bundle has more than one.
 *
 * Reads the bundle value via {@link getKeychainToken} — this pops Touch ID on
 * macOS once, for that bundle-namespaced item (`agents-cli.secrets.*`, gated by
 * `keychainItemRequiresUserPresence` in `../lib/secrets/index.ts`) — then writes
 * it to `keychainItemName(provider)`, a plain `agents-cli.<provider>.token`
 * item. That item matches neither the `agents-cli.secrets.` nor
 * `agents-cli.bundles.` prefix, so every later read of the harness's own key is
 * silent — no repeat Touch ID prompt.
 *
 * Provider precedence: an explicit `--auth-provider` on the same call always
 * wins (freshest intent); otherwise, only when the profile already has a real
 * auth binding (`profile.auth` is set), its own `provider` (so editing an
 * already-provisioned harness rotates its existing key without repeating
 * `--auth-provider`); otherwise the bundle's own name. The `profile.auth`
 * gate matters because `profileFromHostModel`/`forkProfile` default
 * `profile.provider` to the *host* id (e.g. `claude`) even when no auth is
 * attached yet — trusting that default here would silently overwrite the
 * host's own keychain item (`agents-cli.claude.token`) on a bare `--host
 * --model --from-secrets` add with no `--auth-provider`.
 *
 * Attaches `profile.auth` when the profile has none yet (a bare `--host
 * --model` harness, or a native-host fork with no prior auth binding).
 *
 * `allowInheritedAuth` (default `true`) gates the "reuse `profile.auth`'s own
 * provider" branch above. It must be `false` when `profile` came from
 * **forking** an already-provisioned harness: `forkProfile` copies `auth` by
 * reference from the source when no `--auth-provider` override is given, so
 * `profile.auth` being set there means "the SOURCE harness's binding", not
 * "this harness's own" — trusting it would silently overwrite the source's
 * shared keychain item. Editing a harness's own already-established auth is
 * the one case where reuse is genuinely correct, so callers on that path keep
 * the default.
 */
export declare function applyFromSecrets(profile: Profile, spec: string, explicitAuthProvider?: string, opts?: {
    allowInheritedAuth?: boolean;
}): Promise<void>;
/**
 * Create a profile ("custom harness"). Two paths:
 *  - `--host <agent> --model <id>`: one-shot custom harness from a host + model
 *    (no preset needed). This is what makes a model like Muse Spark a named,
 *    runnable harness.
 *  - otherwise: apply a built-in preset (existing behavior).
 * `label` only tunes the success wording (Profile vs Harness). Throws on error.
 */
export declare function addProfile(name: string, opts: AddProfileOptions, label?: 'Profile' | 'Harness'): Promise<void>;
