/**
 * What was done with an operator-token file that could not be read.
 *
 * A token store is a fleet's shared secret: every paired client authenticates
 * with the value in it. When the file was unreadable, truncated by a crash
 * mid-write, half-written, or overwritten with something that is not a token
 * record, the read fell through and MINTED A NEW TOKEN over the top of it.
 * That is a fleet-wide 401 with no record of what happened and no way back:
 * the bytes that every client was holding are gone, and nothing says so.
 *
 * So the unreadable file is moved aside first, under a `.unrecognized`
 * neighbour, and the event is reported. The rotation still happens, a daemon
 * with no readable token cannot serve, but it is now a stated one, with the
 * old file still on disk.
 */
export interface CompanionTokenQuarantine {
    /** The token store that could not be read. */
    readonly from: string;
    /** Where its bytes were moved. Empty when the move itself failed. */
    readonly to: string;
    /** Why it was not usable, in one line. */
    readonly reason: string;
}
export interface CompanionPairingResult {
    readonly token: string;
    readonly peerId: string;
    readonly createdAt: number;
    /**
     * Present only when an unreadable token store was moved aside to mint this
     * one. A caller that surfaces anything to an operator must surface this:
     * every paired client has to pair again.
     */
    readonly quarantined?: CompanionTokenQuarantine | undefined;
}
export interface CompanionConnectionInfo {
    readonly url: string;
    readonly token: string;
    readonly username: string;
    readonly version: string;
    readonly surface: string;
    /** Bootstrap password for companion authentication (omitted if not applicable). */
    readonly password?: string | undefined;
}
export interface CompanionTokenRecord {
    readonly token: string;
    readonly peerId: string;
    readonly createdAt: number;
}
export interface CompanionTokenOptions {
    readonly daemonHomeDir: string;
    readonly regenerate?: boolean | undefined;
    /**
     * Where a quarantine is recorded for the next surface that looks, the
     * daemon's own receipt store (platform/daemon/receipts.ts). Omitted ⇒ the
     * event is logged and returned but nothing carries it to a person.
     */
    readonly receipts?: {
        record(text: string): unknown;
    } | undefined;
}
export interface PruneStaleOperatorTokensOptions {
    readonly daemonHomeDir: string;
    readonly candidatePaths?: readonly string[] | undefined;
}
export interface PruneStaleOperatorTokensResult {
    readonly canonicalPath: string;
    readonly prunedPaths: readonly string[];
    readonly failedPaths: readonly string[];
    readonly skippedPaths: readonly string[];
}
/**
 * Load the stored companion token, or generate and persist a new one.
 * Token is always written to <daemonHomeDir>/operator-tokens.json at mode 0600.
 */
export declare function getOrCreateCompanionToken(options: CompanionTokenOptions): CompanionPairingResult;
export declare function getOrCreateCompanionToken(surface: string, options: CompanionTokenOptions): CompanionPairingResult;
/**
 * Regenerate the companion token, replacing any existing token.
 * Written to <daemonHomeDir>/operator-tokens.json at mode 0600.
 */
export declare function regenerateCompanionToken(options: CompanionTokenOptions): CompanionPairingResult;
export declare function pruneStaleOperatorTokens(options: PruneStaleOperatorTokensOptions): PruneStaleOperatorTokensResult;
/**
 * Build a CompanionConnectionInfo object from raw parameters.
 */
export declare function buildCompanionConnectionInfo(options: {
    daemonUrl: string;
    token: string;
    username?: string | undefined;
    password?: string | undefined;
    version?: string | undefined;
    surface?: string | undefined;
}): CompanionConnectionInfo;
/**
 * Encode a CompanionConnectionInfo as a JSON string suitable for QR encoding.
 */
export declare function encodeConnectionPayload(info: CompanionConnectionInfo): string;
//# sourceMappingURL=companion-token.d.ts.map