/**
 * Returns the list of valid account UUIDs found under `accountsDir`. A dir is
 * "valid" iff its name is a UUID AND it contains a parseable `account.json`.
 * Corruption-discipline: a present-but-unparseable account.json EXCLUDES the
 * dir (over-prune one suspect account beats under-prune the leak it might
 * be hiding).
 */
export declare function enumerateValidAccountIds(accountsDir: string): string[];
/**
 * Membership test with re-scan-on-miss: is `id` a currently-provisioned account
 * under `accountsDir`?
 *
 * Hit path — `id` is in the cached set — returns true with no I/O (the common
 * case; the cache still serves it). Miss path — `id` is absent from the cached
 * set, or the cache is cold — drops the stale entry and re-scans `accountsDir`
 * once (refreshing the cache) before answering.
 *
 * This closes the created-after-boot gap (Task 1471): a sub-account provisioned
 * by the runtime `account_create` lifecycle tool after a consumer process booted
 * is invisible to that process's boot-time cached set. Without the re-scan, the
 * cross-account resolver rejects the id as not-provisioned even though its dir
 * and `account.json` exist on disk. A single `readdirSync` on the miss finds it;
 * a genuinely-absent id pays the same one scan and correctly returns false.
 */
export declare function isProvisionedAccount(accountsDir: string, id: string): boolean;
/**
 * Returns the single `role:"house"` account UUID under `accountsDir`.
 *
 * The registry is the enumerated set of valid account dirs (see
 * `enumerateValidAccountIds`); among them, exactly one must carry
 * `role:"house"`. Throws on zero-house or multiple-house — both are drift the
 * managed-service invariant forbids (`houses=<n>` in the message is the failure
 * signature operators grep for).
 *
 * Deliberately NOT cached: house designation can change at runtime when the
 * operator provisions/archives accounts via the lifecycle tools, so the role
 * lookup reads `account.json` fresh each call. (`enumerateValidAccountIds` is
 * still cached for the dir-validity scan; that set is stable for the process.)
 *
 * Legacy tolerance is intentionally NOT here: a pre-migration account with no
 * `role` does not count as house. `setup-account.sh` stamps `role:"house"` on a
 * sole unlabelled account at seed time, so by manager boot the invariant holds.
 */
export declare function resolveHouseAccountId(accountsDir: string): string;
/**
 * Like `resolveHouseAccountId`, but tolerant of the pre-migration window: when
 * no account carries `role:"house"` AND exactly one valid account exists, that
 * sole account is returned (it is about to be stamped `role:"house"` by
 * `setup-account.sh`). This is the resolver every "the install's account" call
 * site uses (boot account dir, installer account id, channel persist), so a
 * legacy single-account install never throws while waiting for the seed-time
 * role stamp — the WhatsApp persist path in particular must not drop a customer
 * message in that window.
 *
 * Still loud-fails on genuine drift: zero accounts, multiple houses, or
 * zero-house with more than one account (`houses=<n> total=<k>` signature).
 */
export declare function resolveHouseOrSoleAccountId(accountsDir: string): string;
/**
 * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
 * pattern at platform/ui/app/lib/claude-agent/account.ts:9
 * (`ACCOUNTS_DIR = resolve(PLATFORM_ROOT, "..", "data/accounts")`).
 *
 * Loud-throws when the env var is unset — graph-write's gate must not fall
 * open silently.
 */
export declare function getAccountsDirFromEnv(): string;
/**
 * Test-only cache reset. Production callers must not invoke this — the cache
 * is a deliberate boot-time invariant (see module doc).
 */
export declare function _resetEnumerationCache(): void;
/**
 * boot-time env-vs-disk validator. Compares `process.env.ACCOUNT_ID`
 * (stamped by the brand systemd unit's `Environment=ACCOUNT_ID=` line) against
 * the on-disk account set returned by `enumerateValidAccountIds`. The Hono
 * server calls this once at boot before binding the listener; on FATAL it
 * emits a structured `[graph-health] account-id-env FATAL` line and exits 1
 * so systemd's restart loop surfaces the misconfiguration in journalctl.
 *
 * Pure function — no I/O, no env reads, no exits — caller passes both inputs.
 * Reasons enumerate the four observable boot states (success + three failures)
 * with no fallback path; the writeNodeWithEdges gate cannot trust an env that
 * does not match disk, and silently degrading would re-create the silent-leak
 * class the gate exists to close (`.docs/neo4j.md` "Account isolation invariant").
 */
export type AccountIdEnvValidationFailureReason = "missing" | "no-on-disk-account" | "mismatch";
export type AccountIdEnvValidation = {
    ok: true;
    envId: string;
    diskIds: string[];
} | {
    ok: false;
    reason: AccountIdEnvValidationFailureReason;
    envId: string | null;
    diskIds: string[];
};
export declare function validateAccountIdEnv(envValue: string | undefined, diskIds: string[]): AccountIdEnvValidation;
//# sourceMappingURL=index.d.ts.map