export declare function daemonDir(): string;
/**
 * Prove every daemon-owned root component before any token/log/lock writer is
 * allowed to touch it. On first launch the default `~/.claudexor` parent may
 * not exist yet, so create that one owned root before proving the v2 subtree.
 * A custom root must still have a canonical parent supplied by its operator.
 */
export declare function ensureDaemonRuntimeRoot(): string;
/**
 * Windows has no Unix-domain-socket path in the filesystem: Node IPC there
 * rides named pipes (`\\.\pipe\...`). The pipe name carries a digest of the
 * daemon dir so concurrent daemons with distinct `CLAUDEXOR_CONFIG_DIR`s (the
 * D30 shape) get distinct endpoints, exactly like distinct socket files do.
 */
export declare function defaultSocketPath(platform?: NodeJS.Platform): string;
/** The data root's canonical default endpoint, ignoring any socket-spelling
 * override. The issue #165 root-authority barrier anchors HERE (D4): authority
 * follows the data root, so runtimes with custom socket spellings still share
 * one root authority, and the legacy barrier stays at the address pre-fix
 * runtimes contend on. */
export declare function canonicalDefaultSocketPath(platform?: NodeJS.Platform): string;
/** Whether a control endpoint is a Windows named pipe rather than a socket FILE. */
export declare function isWindowsPipePath(path: string): boolean;
export declare function logPath(): string;
/** Read or generate a per-user local auth token (0600), never through links. */
export declare function ensureToken(): string;
export declare function readToken(): string | null;
/**
 * Rotate only a proven owner-controlled token inode. The caller already fences
 * a live daemon; this writer adds no compatibility path that would chmod or
 * overwrite a symlink/hardlink/foreign file.
 */
export declare function rotateToken(): string;
//# sourceMappingURL=token.d.ts.map