import type { ProcessIdentityReader } from "@claudexor/core";
import { type DaemonWriterLease, type DaemonWriterLeaseDependencies } from "./writer-lease.js";
export declare const ROOT_AUTHORITY_SCHEMA_VERSION = 2;
/** First fixed writer-protocol epoch. Pre-fix runtimes have no epoch at all;
 * a record with a lower OR higher epoch than this build supports is refused. */
export declare const ROOT_AUTHORITY_EPOCH = 2;
export interface RootAuthorityRecord {
    schemaVersion: typeof ROOT_AUTHORITY_SCHEMA_VERSION;
    epoch: number;
    /** `vacant` until some fixed runtime proved it could serve this root;
     * `served` afterwards (with `floor` recording that runtime's version). */
    state: "vacant" | "served";
    /** Semantic version of the last fixed runtime that proved it could serve. */
    floor?: string;
}
export type RootAuthorityRefusalCode = "root_authority_unreadable" | "root_authority_epoch_unsupported" | "root_authority_floor_regression" | "root_authority_candidate_invalid" | "root_authority_grant_stale";
export type RootAuthorityStatus = {
    status: "absent";
    markerPath: string;
} | {
    status: "valid";
    markerPath: string;
    record: RootAuthorityRecord;
} | {
    status: "invalid";
    markerPath: string;
    reason: string;
};
/** Fail-closed barrier read: only a physically missing marker is `absent`.
 * C9c: the marker is validated like the startup-diagnostics target — a
 * symlink, a multi-linked file, a foreign uid, or group/other-accessible
 * permissions cannot carry root authority. */
export declare function readRootAuthority(anchorPath: string): RootAuthorityStatus;
/** D2 admission: refuse foreign epochs and strictly lower semantic versions. */
export declare function assertRootAuthorityAdmits(record: RootAuthorityRecord, version: string): void;
export interface RootAuthorityGrant {
    /** The daemon's operational writer lease (socket-adjacent address). */
    readonly lease: DaemonWriterLease;
    /** The barrier record that admitted this candidate. */
    readonly record: RootAuthorityRecord;
    /** Barrier anchor directory (also the canonical lease anchor). */
    readonly anchorPath: string;
    /** D5 stage 4: persist that this exact runtime PROVED it could serve.
     * Monotonic — never lowers an existing floor. Returns the stored record. */
    advanceFloor(): RootAuthorityRecord;
    /** Release the live writer claim(s). The barrier itself persists (D1). */
    release(): void;
}
export interface AcquireRootAuthorityInput {
    socketPath: string;
    /** Candidate's semantic runtime version (engine build identity). */
    version: string;
    identity?: ProcessIdentityReader;
    deps?: Omit<DaemonWriterLeaseDependencies, "identity">;
    /** Test seam: canonical default endpoint of this data root. */
    canonicalSocketPath?: string;
}
/**
 * Stage-1 startup admission: validate/install the permanent barrier, apply
 * the epoch + floor refusals, and claim single-writer authority for this
 * root. On a barrier-less root the flat legacy address is claimed through
 * the shared lease machinery first (live owners refuse, proven-stale owners
 * are quarantined), then the owned generation becomes the barrier in place:
 * owner record atomically swapped for the migration sentinel, marker
 * published, sentinel retired, claim reacquired in the nested slot.
 */
export declare function acquireRootAuthority(input: AcquireRootAuthorityInput): RootAuthorityGrant;
//# sourceMappingURL=root-authority.d.ts.map