import type { AgentId } from './types.js';
/**
 * How safely agents-cli can read a harness's native login identity, and at what
 * granularity that identity is scoped.
 *
 * - `inspection`: `strong` = a stable account key (Claude/Codex/Grok);
 *   `email` = only an email claim, so the name binds to an address not a token
 *   (Muse); `opaque` = a stable but non-human identifier from an OAuth/JWT blob
 *   with no email (the device-scoped harnesses); `none` = no inspectable identity.
 * - `scope`: `version` = auth lives per installed version home; `device` = one
 *   login per device shared by every install; `unsupported` = agents-cli must not
 *   name/attach this harness's native login.
 * - `status`: `supported` = name + attach safely; `conditional` = supported only
 *   when the weaker (email) identity is present; `discovery-only` = shown in the
 *   list but not nameable; `unsupported` = neither.
 */
export interface NativeAccountCapability {
    inspection: 'strong' | 'email' | 'opaque' | 'none';
    scope: 'version' | 'device' | 'unsupported';
    status: 'supported' | 'conditional' | 'discovery-only' | 'unsupported';
}
/** Native-login selector coverage required by RUSH-3053. */
export declare const NATIVE_ACCOUNT_SELECTOR_AGENTS: readonly ["claude", "codex", "cursor", "grok", "kimi"];
/** Explicit dispositions for config-isolated harnesses outside that selector. */
export declare const NATIVE_ACCOUNT_SELECTOR_EXCLUSIONS: Partial<Record<AgentId, string>>;
/** Canonical truth for native-account naming and attachment semantics. */
export declare const NATIVE_ACCOUNT_CAPABILITIES: Record<AgentId, NativeAccountCapability>;
export declare function nativeAccountCapability(agent: AgentId): NativeAccountCapability;
/** Whether a harness's native login can be named/attached (supported or conditional). */
export declare function nativeAccountNameable(agent: AgentId): boolean;
/** Harnesses whose native login is fully nameable/attachable today. */
export declare function supportedNativeHarnesses(): AgentId[];
/**
 * Named reason to refuse native name/attach, or null when the harness is
 * nameable. Provider-credential `accounts add` is a different path and MUST
 * not consult this — that surface is supported for every registered provider.
 */
export declare function nativeAccountNamingRefusal(agent: AgentId): string | null;
/** Fail loud on the native name/attach path for an unsupported harness. */
export declare function assertNativeAccountNameable(agent: AgentId): void;
/**
 * The single identity key used at `accounts name`, attach, exec validation,
 * view, and inventory. Prefer the harness's stable `accountKey`. For an
 * email-only (`conditional`) harness, email is a presence gate — the stored
 * key is still `accountKey` (e.g. `muse:email=user@x.com`), never the bare
 * address, so `run`/`view` compare against the same value `getAccountInfo`
 * returns.
 */
export declare function nativeIdentityKey(info: {
    signedIn?: boolean;
    email?: string | null;
    accountKey?: string | null;
}, capability: NativeAccountCapability): string | null;
