import { type Server } from 'node:net';
import type { CommandInput, CommandResult } from './deployment';
export declare const DEFAULT_DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
/**
 * Execute tenant-controlled project commands under a separate Unix identity.
 *
 * This daemon has no LoadCredential directive and cannot open the owner-only
 * agent socket. The credential-bearing agent may submit an exact command and
 * only the secrets named for that step; the subprocess can steal those values,
 * because it is the intended consumer, but cannot steal the node or Git key.
 */
export declare function startDeploymentRunner(options: {
    root: string;
    home: string;
    socketPath?: string;
    /** Bind closed, then let the service manager transfer access to the Agent. */
    socketMode?: number;
    exec?: (input: CommandInput, home: string) => Promise<CommandResult>;
}): {
    server: Server;
    ready: Promise<void>;
    stop(): Promise<void>;
};
export declare function requestDeploymentCommand(input: CommandInput, socketPath?: string): Promise<CommandResult>;