/** Under $HOME: the dashboard's human-auth secret (ui/server.mjs). */
export declare const DASHBOARD_AUTH_DIR: string;
/** Under $HOME: the org daemons' operator credentials (broker.ts). */
export declare const OPERATOR_DIR: string;
export { authorityFilePaths, CONTROL_FILES, DECISION_FILES, GIT_GUARD_DIR, isAuthorityFile, ORG_STATE_FILES, RUN_STATE_FILES, } from './org-authority-files.js';
/** The directories no role may read. */
export declare function authorityDirs(home: string, env: NodeJS.ProcessEnv): string[];
/** Create the authority dirs (owner-only) so they can be masked before
 *  anything is written into them — a mask over a directory also hides files
 *  created after the role started. */
export declare function ensureAuthorityDirs(home: string, env: NodeJS.ProcessEnv): void;
/** bubblewrap arguments (before `--`) for the mask; see the module doc. */
export declare function authorityMaskArgs(ctx: {
    home: string;
    env: NodeJS.ProcessEnv;
    roots: Array<string | undefined>;
    orgRoot?: string;
    /** The role's cwd and `policy.fileWrite`, for the work dirs to create. */
    cwd?: string;
    fileWrite?: string[];
    /** The role's signed `policy.sandbox.allowWrite` (operator-protected-paths.ts). */
    allowWrite?: string[];
}): string[];
/** Whether the mask can run here: Linux with a bwrap that actually starts
 *  (user namespaces can be disabled even when the binary is installed).
 *  Probed once per process. */
export declare function authorityMaskAvailability(platform?: NodeJS.Platform): {
    available: boolean;
    reason?: string;
};
/** `[command, args]` to spawn: `bin` itself, or `bin` inside the mask. */
export declare function maskedCommand(mask: string[] | undefined, bin: string, args: string[]): [string, string[]];
//# sourceMappingURL=authority-mask.d.ts.map