/**
 * Who may use `CLEO_OWNER_OVERRIDE=1` (T13790, owner decision 2026-10-16).
 *
 * The override stays an env var with no password prompt of its own, but it is
 * honoured only for the owner:
 *  1. **Role fence** (T1118 L4b): a process whose `CLEO_AGENT_ROLE` was
 *     `worker`, `lead` or `subagent` at bootstrap, or changed since, is refused.
 *  2. **Owner-marked session**: the bound session was started interactively
 *     with `cleo session start --scope global --name <n> --owner` — no
 *     password (owner decision: lighter), but refused unless stdin and stderr
 *     are a terminal and no `CLEO_AGENT_ROLE` is set ({@link ownerMarkRefusal}).
 *     No env var marks a session as the owner's, so a parent cannot hand the
 *     mark down. An agent session with no `CLEO_AGENT_ROLE` is therefore
 *     fenced like a worker: it has no mark. (`--owner-auth` and its password
 *     are only for the T13787 cap enrollment; they do not mark a session.)
 *  3. **The owner's own terminal**: the override call itself runs on a TTY
 *     (stdin and stderr). An agent spawned from the owner's session binds to
 *     that same session (it inherits the harness session id or
 *     `CLEO_SESSION_ID`), but its tool shell has no TTY, so it is not the owner
 *     by default.
 * Every refusal is appended to `.cleo/audit/force-bypass.jsonl`.
 *
 * Limits: these are same-OS-user checks. They fence default and accidental
 * agent use; a process that emulates a terminal (`script`, `expect`) can mark a
 * session and pass the TTY check, and a process that writes the session row
 * directly is not stopped. The owner accepted that trade-off for a
 * password-free switch.
 *
 * @task T13790
 */
/** How the owner marks a session, named in every refusal. */
export declare const OWNER_SESSION_COMMAND = "cleo session start --scope global --name owner --owner";
export { ownerMarkRefusal } from './owner-override-auth.js';
/** Whether `CLEO_OWNER_OVERRIDE` asks for an override. */
export declare function isOwnerOverrideRequested(env?: NodeJS.ProcessEnv): boolean;
/** What {@link resolveOwnerOverride} decided. */
export type OwnerOverrideAuthority = {
    requested: false;
} | {
    requested: true;
    allowed: true;
    /** `CLEO_OWNER_OVERRIDE_REASON`, or `unspecified`. */
    reason: string;
    /** The owner-marked session. */
    sessionId: string;
} | {
    requested: true;
    allowed: false;
    code: string;
    message: string;
};
/**
 * Decide whether this process may use `CLEO_OWNER_OVERRIDE=1` (see the module
 * doc), auditing a refusal.
 *
 * @param projectRoot - Project root (session store and audit log).
 * @param opts - The surface asking (named in the audit line), and the session
 *   the caller already resolved; otherwise the bound session is resolved.
 * @returns Not requested, allowed with the reason, or refused with why.
 * @task T13790
 */
export declare function resolveOwnerOverride(projectRoot: string, opts: {
    surface: string;
    taskId?: string;
    sessionId?: string | null;
}): Promise<OwnerOverrideAuthority>;
//# sourceMappingURL=owner-override-authority.d.ts.map