type XenoJsonPrimitive = string | number | boolean | null;
type XenoJsonValue = XenoJsonPrimitive | XenoJsonObject | XenoJsonValue[];
interface XenoJsonObject {
    [key: string]: XenoJsonValue;
}
declare const XENO_SHARE_SCHEMA_VERSION: 2;
declare const XENO_HANDOFF_SCHEMA_VERSION: 1;
declare const XENO_SHARE_REGISTRY_SCHEMA_VERSION: 1;
type XenoShareVisibility = "private" | "workspace" | "team" | "link";
type XenoShareSurface = "cli" | "hub" | "hosted" | "api" | `custom:${string}`;
type XenoShareStatus = "active" | "revoked" | "expired";
interface XenoShareIssuer {
    id: string;
    displayName?: string;
    workspaceId?: string;
    teamId?: string;
}
interface XenoShareGitContext {
    repositoryId?: string;
    remoteUrl?: string;
    branch?: string;
    commit?: string;
    pullRequest?: {
        provider: "github" | "gitlab" | "bitbucket" | `custom:${string}`;
        repository: string;
        number: number;
        url?: string;
    };
}
interface XenoShareSessionIdentity {
    name: string;
    sessionId?: string;
    runId?: string;
    hostedRunId?: string;
    conversationId?: string;
    parentSessionId?: string;
    forkedFromSessionId?: string;
    forkedAtEventId?: string;
    surface: XenoShareSurface;
    git?: XenoShareGitContext;
}
interface XenoShareReference {
    kind: "artifact" | "finding" | "agent-session" | "task" | "commit" | "pull-request" | `custom:${string}`;
    id: string;
    title?: string;
    uri?: string;
    hash?: string;
}
type XenoRedactionCategory = "secret-field" | "credential-pattern" | "authorization" | "url-secret" | "environment-secret" | "private-key" | "email" | "home-path" | "workspace-path" | "binary" | "cycle" | "truncated";
interface XenoRedactionEvent {
    path: string;
    category: XenoRedactionCategory;
}
interface XenoRedactionReport {
    schemaVersion: 1;
    total: number;
    byCategory: Partial<Record<XenoRedactionCategory, number>>;
    events: XenoRedactionEvent[];
    eventsTruncated: boolean;
}
interface XenoShareContent {
    summary?: string;
    transcript?: XenoJsonValue[];
    activity?: XenoJsonValue[];
    metadata?: XenoJsonValue;
    evidence?: XenoJsonValue[];
}
interface XenoShareAccessPolicy {
    mode: "read-only";
    visibility: XenoShareVisibility;
    workspaceId?: string;
    teamId?: string;
    allowedPrincipalIds?: string[];
    capabilityToken: {
        algorithm: "sha256";
        hash: string;
    };
}
interface XenoSharePayload {
    schemaVersion: typeof XENO_SHARE_SCHEMA_VERSION;
    kind: "xeno-secure-share";
    shareId: string;
    createdAt: string;
    expiresAt: string;
    issuer: XenoShareIssuer;
    session: XenoShareSessionIdentity;
    access: XenoShareAccessPolicy;
    content: XenoShareContent;
    references: XenoShareReference[];
    redaction: XenoRedactionReport;
}
interface XenoEd25519Signature {
    algorithm: "ed25519";
    keyId: string;
    value: string;
    publicKeySpki?: string;
}
interface XenoSignedShareEnvelope {
    payload: XenoSharePayload;
    signature: XenoEd25519Signature;
}
interface XenoShareSigningIdentity {
    keyId: string;
    publicKeyPem: string;
    privateKeyPem: string;
}
interface XenoCreatedShare {
    envelope: XenoSignedShareEnvelope;
    capabilityToken: string;
    url: string;
}
interface XenoSharePrincipal {
    id?: string;
    workspaceId?: string;
    teamIds?: string[];
}
interface XenoShareVerificationResult {
    valid: boolean;
    integrityValid: boolean;
    issuerTrusted: boolean;
    capabilityValid: boolean;
    audienceAllowed: boolean;
    status: XenoShareStatus;
    errors: string[];
}
interface XenoHandoffTarget {
    surface: XenoShareSurface;
    workspaceId?: string;
    teamId?: string;
    environmentId?: string;
    repositoryId?: string;
}
interface XenoHandoffResumePoint {
    sessionId?: string;
    runId?: string;
    hostedRunId?: string;
    checkpointId?: string;
    transcriptEventId?: string;
    artifactIds?: string[];
    taskIds?: string[];
}
interface XenoHandoffAuthority {
    filesystem: "none" | "read" | "workspace-write";
    network: "deny" | "allowlist" | "prompt";
    externalActions: "deny" | "prompt";
    secretRefs: string[];
}
interface XenoHandoffPayload {
    schemaVersion: typeof XENO_HANDOFF_SCHEMA_VERSION;
    kind: "xeno-session-handoff";
    handoffId: string;
    createdAt: string;
    expiresAt: string;
    issuer: XenoShareIssuer;
    source: XenoShareSessionIdentity;
    target: XenoHandoffTarget;
    resume: XenoHandoffResumePoint;
    authority: XenoHandoffAuthority;
    references: XenoShareReference[];
    shareId?: string;
}
interface XenoSignedHandoffEnvelope {
    payload: XenoHandoffPayload;
    signature: XenoEd25519Signature;
}
interface XenoShareRegistryRecord {
    shareId: string;
    envelope: XenoSignedShareEnvelope;
    status: XenoShareStatus;
    registeredAt: string;
    origin: "created" | "imported";
    revokedAt?: string;
    revokedBy?: string;
    revocationReason?: string;
}
interface XenoShareRegistrySnapshot {
    schemaVersion: typeof XENO_SHARE_REGISTRY_SCHEMA_VERSION;
    generation: number;
    updatedAt: string;
    records: XenoShareRegistryRecord[];
    checksum: {
        algorithm: "sha256";
        value: string;
    };
}
interface XenoRedactionOptions {
    workspaceRoot?: string;
    homeDirectory?: string;
    redactEmails?: boolean;
    maxDepth?: number;
    maxStringLength?: number;
    maxEvents?: number;
}
interface XenoRedactionResult<T extends XenoJsonValue = XenoJsonValue> {
    value: T;
    report: XenoRedactionReport;
}
declare function redactXenoShareValue<T extends XenoJsonValue = XenoJsonValue>(input: unknown, options?: XenoRedactionOptions): XenoRedactionResult<T>;
interface CreateXenoShareOptions {
    name: string;
    issuer: XenoShareIssuer;
    session: Omit<XenoShareSessionIdentity, "name"> & {
        name?: string;
    };
    visibility?: XenoShareVisibility;
    workspaceId?: string;
    teamId?: string;
    allowedPrincipalIds?: string[];
    content: XenoShareContent;
    references?: XenoShareReference[];
    expiresAt?: string;
    ttlMs?: number;
    baseUrl?: string;
    signingIdentity: XenoShareSigningIdentity;
    redaction?: XenoRedactionOptions;
    now?: Date;
    shareId?: string;
}
interface VerifyXenoShareOptions {
    capabilityToken?: string;
    principal?: XenoSharePrincipal;
    trustedPublicKeys?: ReadonlyMap<string, string> | Record<string, string>;
    allowEmbeddedPublicKey?: boolean;
    revokedShareIds?: ReadonlySet<string>;
    now?: Date;
}
interface CreateXenoHandoffOptions {
    issuer: XenoShareIssuer;
    source: XenoShareSessionIdentity;
    target: XenoHandoffTarget;
    resume: XenoHandoffResumePoint;
    authority: XenoHandoffAuthority;
    references?: XenoShareReference[];
    shareId?: string;
    expiresAt?: string;
    ttlMs?: number;
    signingIdentity: XenoShareSigningIdentity;
    now?: Date;
    handoffId?: string;
}
declare function createXenoShareSigningIdentity(): XenoShareSigningIdentity;
declare function publicKeyFingerprint(publicKeyPem: string): string;
declare function createXenoSecureShare(options: CreateXenoShareOptions): XenoCreatedShare;
declare function signSharePayload(payload: XenoSignedShareEnvelope["payload"], identity: XenoShareSigningIdentity): XenoSignedShareEnvelope;
declare function verifyXenoSecureShare(envelope: XenoSignedShareEnvelope, options?: VerifyXenoShareOptions): XenoShareVerificationResult;
declare function createXenoSessionHandoff(options: CreateXenoHandoffOptions): XenoSignedHandoffEnvelope;
declare function verifyXenoSessionHandoff(envelope: XenoSignedHandoffEnvelope, options?: Pick<VerifyXenoShareOptions, "trustedPublicKeys" | "allowEmbeddedPublicKey" | "now">): {
    valid: boolean;
    integrityValid: boolean;
    issuerTrusted: boolean;
    expired: boolean;
    errors: string[];
};
interface FileXenoShareRegistryOptions {
    directory: string;
    now?: () => Date;
}
declare class FileXenoShareRegistry {
    readonly directory: string;
    readonly snapshotPath: string;
    readonly lockPath: string;
    private readonly now;
    constructor(options: FileXenoShareRegistryOptions);
    register(envelope: XenoSignedShareEnvelope, origin?: "created" | "imported"): Promise<XenoShareRegistryRecord>;
    revoke(shareId: string, actor: string, reason: string): Promise<XenoShareRegistryRecord>;
    get(shareId: string): Promise<XenoShareRegistryRecord | null>;
    list(): Promise<XenoShareRegistryRecord[]>;
    revokedIds(): Promise<Set<string>>;
    load(): Promise<XenoShareRegistrySnapshot>;
    private mutate;
}
export { type CreateXenoHandoffOptions, type CreateXenoShareOptions, FileXenoShareRegistry, type FileXenoShareRegistryOptions, type VerifyXenoShareOptions, XENO_HANDOFF_SCHEMA_VERSION, XENO_SHARE_REGISTRY_SCHEMA_VERSION, XENO_SHARE_SCHEMA_VERSION, type XenoCreatedShare, type XenoEd25519Signature, type XenoHandoffAuthority, type XenoHandoffPayload, type XenoHandoffResumePoint, type XenoHandoffTarget, type XenoRedactionCategory, type XenoRedactionEvent, type XenoRedactionOptions, type XenoRedactionReport, type XenoRedactionResult, type XenoShareAccessPolicy, type XenoShareContent, type XenoShareGitContext, type XenoShareIssuer, type XenoSharePayload, type XenoSharePrincipal, type XenoShareReference, type XenoShareRegistryRecord, type XenoShareRegistrySnapshot, type XenoShareSessionIdentity, type XenoShareSigningIdentity, type XenoShareStatus, type XenoShareSurface, type XenoShareVerificationResult, type XenoShareVisibility, type XenoSignedHandoffEnvelope, type XenoSignedShareEnvelope, createXenoSecureShare, createXenoSessionHandoff, createXenoShareSigningIdentity, publicKeyFingerprint, redactXenoShareValue, signSharePayload, verifyXenoSecureShare, verifyXenoSessionHandoff };