import type { AccountIdentity } from "@claudexor/schema";
export declare const CLAUDE_KEYCHAIN_BRIDGE_ENV = "CLAUDEXOR_CLAUDE_KEYCHAIN_BRIDGE";
export declare const CLAUDE_NATIVE_DIR_ENV = "CLAUDEXOR_CLAUDE_NATIVE_DIR";
export interface ClaudeNativeHomeOptions {
    platform?: NodeJS.Platform;
    userHome?: string;
}
/**
 * Claudexor-owned default store; ordinary ~/.claude is never used.
 *
 * The `CLAUDEXOR_CLAUDE_NATIVE_DIR` override is read from the AUTHORITATIVE run
 * env first (the exact env the claude child spawns under, threaded through
 * `claudeNativeEnv`/`probeAuthStatus`), falling back to `process.env` — reading
 * only `process.env` made the doctor/run auth probe ignore an override carried
 * in the run env and silently probe the default store (symmetry with codex's
 * defaultNativeCodexHome). The config-root ownership guard still applies.
 */
export declare function defaultNativeClaudeConfigDir(env?: Record<string, string | null | undefined>): string;
/**
 * Give ONLY the Claude child a disposable HOME that can discover the user's
 * macOS login Keychain. The generic envelope HOME remains unbridged.
 *
 * Claude Code keys its own credential item by the exact CLAUDE_CONFIG_DIR,
 * but locates the login Keychain via HOME/Library/Keychains. A scoped HOME
 * therefore makes a valid native login look logged-out. This narrow symlink
 * bridge exposes the same OS-keychain context a normal native Claude process
 * receives without copying/exporting credentials or exposing the rest of the
 * user's HOME. The child HOME remains under the envelope and is disposed with
 * it.
 */
export declare function claudeNativeHomeEnv(base: Record<string, string | null | undefined>, options?: ClaudeNativeHomeOptions): Record<string, string | null | undefined>;
/**
 * DAEMON-SIDE, PURE, non-secret identity reader for a claude account (INV-067).
 *
 * Given a Claudexor-owned CLAUDE_CONFIG_DIR (a profile's isolation_locator or
 * the native `defaultNativeClaudeConfigDir`), read the account's OWN
 * `.claude.json` and project ONLY the allowlisted `{email, plan}` out of its
 * `oauthAccount`. Session tokens and every other oauthAccount field never leave
 * this function. Containment is enforced HERE: a config dir outside the
 * Claudexor-owned root (the ordinary vendor `~/.claude` above all) is refused
 * WITHOUT a read. Missing/malformed/undisclosed → `null`, never a throw.
 */
export declare function claudeAccountIdentity(configDir: string | null | undefined): AccountIdentity | null;
//# sourceMappingURL=native-home.d.ts.map