/**
 * Single-backend guard: assert the agent and the rubric judge run through the
 * SAME backend config, so the judge can't silently re-route through a
 * different (often paid) backend than the agent.
 *
 * The bug class: `--backend cli-bridge` rewires the agent, but the judge still
 * reads `process.env.TANGLE_API_KEY` → router. Cost is billed against the
 * router, the eval reports the cli-bridge model, and the data is unusable.
 * Four consumers hand-roll this comparison (legal at `canonical.ts:702-795`);
 * this is the one substrate copy.
 *
 * Complements `assertRealBackend` (records → stub vs real) and
 * `assertCrossFamily` (judge-ensemble family diversity): this one compares two
 * backend *configs* before the run.
 */
import { AgentEvalError } from '../errors';
/**
 * Minimal backend-config shape the assertion reads. Consumers may pass richer
 * types — only these five fields are inspected.
 */
export interface BackendDescriptor {
    /** Backend route — e.g. `'tcloud' | 'cli-bridge' | 'sandbox' | 'direct-provider'`;
     *  free-form for consumer extensibility. */
    kind: string;
    /** Resolved base URL. Compared lexically (trailing slash stripped). */
    baseUrl: string;
    /** Model id (with snapshot suffix). Compared lexically. */
    model: string;
    /** Optional provider override. Compared when both set; flagged when only
     *  one side sets it. */
    provider?: string;
    /** Bearer token. Values are NEVER compared (security) — only that EITHER
     *  both are set OR both are empty. Mismatched presence is a divergence. */
    apiKey?: string;
}
export interface AssertSingleBackendOptions {
    /** When true, ANY field divergence fails. When false (default), only
     *  `kind` / `baseUrl` / `provider` / `apiKeyPresence` divergence throws —
     *  a different judge `model` on the same route is allowed (the legal
     *  pattern: a cheaper judge model). */
    strict?: boolean;
    agentLabel?: string;
    judgeLabel?: string;
}
export type SingleBackendField = 'kind' | 'baseUrl' | 'model' | 'provider' | 'apiKeyPresence';
export interface SingleBackendDivergence {
    field: SingleBackendField;
    agent: string | undefined;
    judge: string | undefined;
}
export interface SingleBackendReport {
    /** True when agent + judge agree per the configured strictness. */
    ok: boolean;
    /** Every divergence detected (includes `model` even when non-blocking). */
    divergences: ReadonlyArray<SingleBackendDivergence>;
}
export declare class SingleBackendError extends AgentEvalError {
    readonly report: SingleBackendReport;
    constructor(message: string, report: SingleBackendReport);
}
/**
 * Throw `SingleBackendError` when the agent and judge backends diverge in a
 * way that would re-route the judge through a different backend than the
 * agent. Returns the report so callers can log it in either case.
 */
export declare function assertSingleBackend(agent: BackendDescriptor, judge: BackendDescriptor, opts?: AssertSingleBackendOptions): SingleBackendReport;
//# sourceMappingURL=single-backend.d.ts.map