/** Cloudflare One MDM document; callers keep both token values out of argv/env. */
export declare function renderWarpMdm(options: {
    organization: string;
    clientId: string;
    clientSecret: string;
}): string;
/**
 * Materialize enrollment only in /run. The durable /var/lib path is a symlink,
 * so neither service-token half is left as plaintext on the filesystem.
 */
export declare function materializeWarpMdm(options: {
    organization: string;
    clientId: string;
    clientSecret: string;
    runtimePath?: string;
    servicePath?: string;
}): {
    runtimePath: string;
    servicePath: string;
};