export declare const PLATFORM_SECRET_AUTHORITY_DROP_IN = "/etc/systemd/system/forgezero@.service.d/20-secret-authority.conf";
export declare const PLATFORM_AGENT_SECRET_AUTHORITY_DROP_IN = "/etc/systemd/system/forgezero-agent.service.d/20-secret-authority.conf";
export declare const PLATFORM_SECRET_AUTHORITY_RECEIPT = "/var/lib/forgezero/platform-secret-authority.json";
export type PlatformSecretAuthorityState = 'bootstrap' | 'activating' | 'managed' | 'recovery';
export interface PlatformSecretAuthorityDirective {
    generation: number;
    state: 'managed';
    verificationDigest: `sha256:${string}`;
    verifiedAtTs: number;
    recoveryCredential: 'fz_smtp.password' | 'fz_jetemail.apiKey';
}
export interface PlatformSecretAuthorityReceipt extends PlatformSecretAuthorityDirective {
    appliedAtTs: number;
    removedCredentials: readonly string[];
}
export interface PlatformSecretAuthorityHost {
    exists(path: string): boolean;
    read(path: string): string;
    writeAtomic(path: string, content: string, mode: number): void;
    remove(path: string): void;
    exec(argv: readonly string[]): Promise<{
        exitCode: number;
        output: string;
    }>;
    now(): number;
}
export declare function readPlatformSecretAuthorityReceipt(path?: string, host?: Pick<PlatformSecretAuthorityHost, 'exists' | 'read'>): PlatformSecretAuthorityReceipt | undefined;
/**
 * Makes Vault authority durable without copying a secret through the Agent.
 * The host keeps machine capabilities, retains one recovery mail credential on
 * disk, and removes every broad managed-runtime fallback before the next slot.
 */
export declare function applyPlatformSecretAuthority(directive: PlatformSecretAuthorityDirective, host?: PlatformSecretAuthorityHost): Promise<PlatformSecretAuthorityReceipt>;