/**
 * Owned per-agent runtime storage (see the `subagent-runtime-storage`
 * capability).
 *
 * Each new spawn gets exactly one tmux-pilot-owned runtime directory:
 *
 *   <getHostStorageDir()>/tmp/subagents/<parentSessionId>/<agentId>/runtime
 *
 * All of a built-in harness's per-agent lifecycle files (status jsonl, ready
 * file, lifecycle-end sentinel, disposable session mirror) live inside it,
 * instead of ambient `$TMPDIR` — so a future mount-namespace sandbox that
 * gives the child a private `/tmp` can bind exactly this one narrow directory
 * and the parent/child lifecycle channel stays shared.
 *
 * The location derives ONLY from host storage (layer A) and spawn identity —
 * a role's `harness-config-directory` override (layer B) never relocates it.
 * The dedicated `runtime/` child keeps the sandbox bind narrow even when the
 * adjacent config directory is user-routed elsewhere, and keeps removal
 * scoped when the default pi config dir is the ancestor `<parent>/<agent>/`.
 *
 * Recursive removal is protected by a strict ownership gate
 * (`isOwnedRuntimeDir`): only the exact expected `runtime` child beneath the
 * record's host-storage parent/agent subtree is ever a recursive-deletion
 * target — never an arbitrary path supplied by a record or harness.
 *
 * Host-neutral: no pi package imports (enforced by
 * `test/host-import-boundary.test.ts`).
 */
/** Identity of the spawn that owns a runtime directory. */
export interface RuntimeDirIds {
    /**
     * Parent session id. Optional at VALIDATION time (a record may predate the
     * field), in which case only the agent segment is matched; always present
     * at allocation time.
     */
    parentSessionId?: string;
    agentId: string;
}
/**
 * Resolve (without creating) the owned runtime directory for a spawn.
 * Throws on malformed id segments — the path must never be derivable from
 * ids that would escape the per-agent subtree.
 */
export declare function resolveRuntimeDir(parentSessionId: string, agentId: string): string;
/**
 * Resolve AND create the runtime directory for a new spawn. Called by the
 * spawner immediately before `harness.setupEnvironment()`.
 */
export declare function allocateRuntimeDir(parentSessionId: string, agentId: string): string;
/**
 * SAFETY GATE: is `runtimeDir` the exact owned `runtime` directory for this
 * spawn identity?
 *
 * Requires, after path resolution:
 *  - strictly inside `<host-storage>/tmp/subagents` (no `..` escape),
 *  - exactly `<parent>/<agent>/runtime` deep (never the base, a parent
 *    subtree, or anything shallower/deeper),
 *  - the agent segment equal to `ids.agentId`,
 *  - the parent segment equal to `ids.parentSessionId` when known.
 *
 * A forged or corrupted record pointing `runtimeDir` anywhere else — an
 * ancestor, a sibling agent, outside host storage — is refused.
 */
export declare function isOwnedRuntimeDir(runtimeDir: string | undefined, ids: RuntimeDirIds): boolean;
/** Outcome of a validated runtime-directory removal attempt. */
export type RuntimeDirRemoval = "removed" | "missing" | "refused";
/**
 * Recursively remove a validated runtime directory. Best-effort and
 * idempotent: an already-gone directory reports `"missing"` (success for
 * cleanup purposes); a path failing the ownership gate reports `"refused"`
 * and is never touched. Throws only on a real filesystem failure of the
 * validated target — callers treat that as a collectable error.
 *
 * After removal, the now-empty `<agent>`/`<parent>` ancestors created by
 * allocation are pruned with NON-recursive rmdir — an ancestor holding
 * anything else (e.g. the default pi config dir at `<agent>/`) fails the
 * rmdir and is left for its own owner (config-dir teardown) to remove.
 */
export declare function removeRuntimeDir(runtimeDir: string | undefined, ids: RuntimeDirIds): RuntimeDirRemoval;
//# sourceMappingURL=runtime-storage.d.ts.map