import { type AuthPrepared } from "@cotal-ai/core";
import { type LocalProcess } from "@cotal-ai/workspace";
export { resolveAuthProvider } from "@cotal-ai/core";
/** Reclaim a DEAD pre-hex pidfile before a fresh start claims the canonical (hex) slot. A crash on
 *  a pre-upgrade build leaves `auth-service.<encoded>.pid`; the new start claims
 *  `auth-service.<hex>.pid` and, without this, BOTH would then exist - which `readPidPath` correctly
 *  refuses as ambiguous, wedging every later status/down.
 *
 *  It reclaims ONLY what the canonical claim ({@link claimAuthPidSlot}) would: an empty slot (a
 *  pre-protocol crash) or a positive finite PID proven DEAD. It NEVER deletes an unattributable
 *  record - garbled/non-numeric/non-positive content, or a still-LIVE legacy holder - because that
 *  is exactly the live pre-hex signer this whole path exists not to orphan (a torn or tampered
 *  pidfile of a running service reads as garbled). Those cases THROW so the start aborts loud rather
 *  than delete the record and launch a competing service. Byte-exact match, no case-fold. Exported
 *  for the boundary smoke, which must exercise the real reclaim, not a stand-in. */
export declare function reclaimDeadLegacyPid(space: string): void;
/** True if the auth service we started for THIS space is still running (pid file + liveness). */
export declare function authServiceUp(space: string): boolean;
/** EXCLUSIVE pidfile claim (#29 HIGH 3 belt): the slot is published ATOMICALLY and
 *  PRE-POPULATED, so no reader can ever observe a legitimately-empty claim and no create/write
 *  window exists to race. The claimant writes its own pid to a unique temp inode in the same
 *  directory, then publishes it with `link(2)` — an atomic no-overwrite operation — as the slot
 *  path (the held fd stays the published inode; the caller later replaces the content with the
 *  daemon child's pid through it). This is the cheap HOST-LAYER belt only — the broker-visible
 *  exclusion is the plane claim inside `openAuthAuthorityPlane` (a second plane refuses there
 *  even if it somehow gets spawned; SPEC 13.13). Outcomes:
 *   - `{ fd }`: this launcher owns the slot;
 *   - `{ livePid }`: a LIVE holder already owns it (the daemon, or a launcher mid-spawn whose
 *     daemon the caller's ready() poll adjudicates) — use that one;
 *   - `undefined`: yield — garbled content, or still contested after one retry; never steal what
 *     cannot be attributed.
 *  A slot naming a provably DEAD pid — and an EMPTY slot, which the atomic pre-populated publish
 *  makes impossible to produce except by a pre-protocol crash — is removed and the claim retried
 *  ONCE, so a crash can never wedge the slot permanently. */
export declare function claimAuthPidSlot(space: string): {
    fd: number;
} | {
    livePid: number;
} | undefined;
/** Make the user-auth service available for a space: start the provider's daemon unless it's
 *  already up, then wait on the provider's readiness contract (both planes bound). The wait is
 *  bound to the daemon process (#1931): while the pid this call launched (or found live) is
 *  provably alive, the provider waits past the base clock to a fixed upper bound instead of
 *  misreporting a still-binding daemon as dead, and a daemon that exited refuses at once.
 *  Returns the provider-reported runtime endpoints for the mesh registry. THROWS with the
 *  reason + the log path on a service that never became ready — the caller surfaces it loudly
 *  (U5); user-mode `up` must never quietly succeed with a dead auth plane. */
export declare function ensureAuthService(opts: {
    space: string;
    server: string;
    stateDir: string;
    prepared: AuthPrepared;
    /** Extra daemon argv (argv array — never shell interpolation), e.g. the public-exchange flags
     *  `up` threads through. Applied only when THIS call starts the daemon; an already-running
     *  service keeps the flags it was started with (restart via `cotal down`/`up` to change them). */
    extraArgs?: string[];
}): Promise<Record<string, unknown>>;
/** The user-auth service as a local process: `cotal down` and `up`'s teardown stop it through this one
 *  descriptor, so both take the same reservation, identity check and SIGKILL escalation. */
export declare const AUTH_PROCESS: LocalProcess;
/** Stop THIS space's auth service with the stop bare `cotal down` runs for it. Scoped by the
 *  space-carrying pidfile, never a root-global kill. Throws, with the record kept, when the stop is
 *  refused or the death is not confirmed. */
export declare function stopAuthService(space: string): Promise<void>;
//# sourceMappingURL=auth-proc.d.ts.map