export declare const OWNER_IDENTITY_SCHEMA_VERSION: 1;
export declare const OWNER_IDENTITY_FILE_NAME = "owner.json";
export interface OwnerIdentityRecord {
    schemaVersion: number;
    ownerId: string;
    credentialId: string;
    registeredAt: string;
}
export type OwnerIdentitySource = 'env' | 'file' | 'none' | 'invalid_env';
export interface OwnerIdentityResolved {
    ownerId: string | null;
    credentialId: string | null;
    source: OwnerIdentitySource;
    /**
     * Machine-readable failure reason. Present when source is 'invalid_env'
     * (partial/empty env override) or when the registration file could not be
     * read (non-ENOENT filesystem failure). Never contains identity values.
     */
    error?: string;
}
export type OwnerIdentityFileResult = {
    ok: true;
    record: OwnerIdentityRecord;
} | {
    ok: false;
    error: string;
};
export type OwnerIdentityDeleteResult = {
    ok: true;
} | {
    ok: false;
    error: string;
};
export declare function ownerIdentityFilePath(homeDir: string): string;
export declare function defaultOwnerIdentityHomeDir(): string;
/**
 * Read ~/.pd/owner.json. Absent file (ENOENT) => { record: null } — a valid
 * "not registered" state. Malformed content => { record: null, error }. Any
 * other filesystem failure (EACCES, EISDIR, EPERM, I/O) => { record: null,
 * error: 'owner_identity_read_failed: <code>' } — it must never be
 * interpreted as "Owner not registered".
 */
export declare function readOwnerIdentityFile(homeDir: string): {
    record: OwnerIdentityRecord | null;
    error?: string;
};
/**
 * Write ~/.pd/owner.json (mkdir -p, then confirm by re-read). Trims input;
 * rejects empty ownerId/credentialId.
 */
export declare function writeOwnerIdentityFile(homeDir: string, input: {
    ownerId: string;
    credentialId: string;
}): OwnerIdentityFileResult;
/**
 * Delete ~/.pd/owner.json. Absent file is a no-op success (unregister is
 * idempotent). Uses unlinkSync (not rmSync) to avoid any rm-interception.
 */
export declare function deleteOwnerIdentityFile(homeDir: string): OwnerIdentityDeleteResult;
/**
 * Resolve the Owner identity — the atomic-pair truth table (ADR-0022):
 *
 *   A. neither env key set                 -> ~/.pd/owner.json (or none)
 *   B. both keys set and non-empty (trim)  -> env
 *   C/D/E. anything else where at least    -> INVALID (fail-closed):
 *          one key is explicitly set          no file fallback, no identity
 */
export declare function resolveOwnerIdentity(env: Record<string, string | undefined>, homeDir: string): OwnerIdentityResolved;
//# sourceMappingURL=owner-identity.d.ts.map