/**
 * testAsSelfValidation — pure input guards for `instar test-as-self`.
 *
 * The harness deploys a THROWAWAY agent. These guards make it structurally
 * impossible to (a) point the throwaway at a real/protected agent home or
 * (b) accept a raw bot token on the command line (tokens must flow through
 * Secret Drop — never argv/env/transcript). Pure + synchronous so the
 * decision boundary is fully unit-testable; the command wires real paths in.
 *
 * Spec: MULTI-MACHINE-BOOTSTRAP-ROBUSTNESS §Track F (the Part 2.1 harness),
 * "Forbidden inputs".
 */
export interface TargetGuardOptions {
    /** Absolute path of the agent home the command is running FROM (never a target). */
    canonicalHome: string;
    /** Agent names that must never be used as a throwaway target (e.g. ['bob']). */
    protectedNames: string[];
    /** Optional: absolute homes that are off-limits regardless of name (e.g. a known Bob path). */
    protectedHomes?: string[];
}
export interface GuardResult {
    ok: boolean;
    /** Stable machine-readable reason code (also the suggested process exit semantics). */
    code: 'ok' | 'target-is-canonical' | 'target-is-protected' | 'raw-token-on-cli' | 'empty-target';
    reason?: string;
}
/** True if `value` looks like a raw secret token (must NOT be accepted on argv). */
export declare function isRawToken(value: string): boolean;
/**
 * Validate the `--target` throwaway-home path. Rejects:
 *  - empty,
 *  - the canonical (running) agent home,
 *  - a home whose final path segment is a protected agent name (e.g. `bob`),
 *  - any explicitly protected home path.
 */
export declare function validateTarget(target: string | undefined, opts: TargetGuardOptions): GuardResult;
/**
 * Validate the `--bot-token` argument. It must be a Secret Drop ID reference,
 * NEVER a raw token. A raw-token value is refused so a secret can't land in
 * argv / shell history / the transcript.
 */
export declare function validateBotTokenArg(arg: string | undefined): GuardResult;
//# sourceMappingURL=testAsSelfValidation.d.ts.map