import { ProtectedRecordStore } from "./protected-records.js";
import type { ServiceInstance } from "./service-instances.js";
export interface ServiceSupervisorRecord {
    schemaVersion: 1;
    space: string;
    instanceId: string;
    definition: string;
    definitionRevision: string;
    machine: string;
    uid: number;
    mechanism: "systemd-user" | "launchd";
    unit: string;
    unitPath: string;
    unitSha256: string;
    privateHome: string;
    environmentSha256?: string;
    searchPath?: string;
    privateTreeSha256?: string;
    seededGeneration: string;
    installedAt: string;
}
export declare const serviceSupervisorStore: (space: string) => ProtectedRecordStore<ServiceSupervisorRecord>;
/** Hash only the recorded physical unit file. No unit body, environment or native process
 *  diagnostics leave this view, and matching bytes do not establish loaded/active OS state. */
export declare function serviceSupervisorProjection(instance: ServiceInstance, current: Pick<ServiceInstance["host"], "machine" | "uid">): {
    mechanism: "none-recorded";
    fileObservation: "not-checked";
    osState: "not-checked";
    autostart: "not-checked";
    unit: null;
    unitPath: null;
    privateHome: null;
    seededGeneration: null;
    installedAt: null;
} | {
    mechanism: "systemd-user" | "launchd";
    fileObservation: "foreign-host";
    osState: "not-checked";
    autostart: "not-checked";
    unit: string;
    unitPath: string;
    privateHome: string;
    seededGeneration: string;
    installedAt: string;
} | {
    mechanism: "systemd-user" | "launchd";
    fileObservation: "unreadable" | "missing" | "matches-recorded-bytes" | "modified";
    osState: "not-checked";
    autostart: "not-checked";
    unit: string;
    unitPath: string;
    privateHome: string;
    seededGeneration: string;
    installedAt: string;
};
/** OS controls are a separate path. A stopped PID or missing/modified unit never authorizes the
 *  direct-process driver to bypass a recorded supervisor, reinstall it or remove its receipt. */
export declare function refuseRecordedSupervisor(instance: ServiceInstance, operation: "start" | "stop" | "remove"): void;
//# sourceMappingURL=service-supervision.d.ts.map