import * as plugins from './plugins.js';
/**
 * The two Unix endpoints of the per-user authswitch account authority.
 *
 * The production pair is never spelled out here: `resolveAuthSwitchAuthorityPaths` in authswitch is
 * the only definition of where the daemon listens, and a second copy in AGL would drift the moment
 * the daemon moved. A test supplies its own pair instead, which is also what keeps the suite off the
 * real authority.
 */
export interface IAuthoritySocketPaths {
    managementSocketPath: string;
    runtimeSocketPath: string;
}
/**
 * Why the authority endpoints could not be derived on this host.
 *
 * It is deliberately not the projection's unavailable reason: that one names what a view shows,
 * this one names who has to act. A host that never installed the authority is an ordinary state; an
 * environment that cannot be read is the owner's to fix and is therefore reported.
 */
export type TAuthorityPathsProblem = 
/** No private runtime directory at all -- the authority was never installed for this user. */
'no_runtime_directory'
/** A runtime directory exists but the environment around it is unusable, e.g. a relative `XDG_DATA_HOME`. */
 | 'unusable_environment';
export declare class AuthorityPathsUnavailableError extends Error {
    readonly problem: TAuthorityPathsProblem;
    constructor(problem: TAuthorityPathsProblem, messageArg: string, causeArg: unknown);
}
/**
 * Where the daemon listens for this user.
 *
 * A host without a private runtime directory has no authority to talk to, which is an ordinary state
 * on a machine where the account authority was never installed -- so it is reported as one instead
 * of failing startup.
 */
export declare const resolveProductionAuthoritySocketPaths: () => IAuthoritySocketPaths;
/**
 * The one client AGL uses to reach the authority.
 *
 * Both endpoints are handed over together because the client owns both: the credential-free
 * management socket and the backend-only runtime socket. `AuthSwitchClient` opens one bounded
 * connection per request and holds no socket between calls, so this object owns no resource and
 * needs no shutdown of its own.
 */
export declare const createAuthorityClient: (pathsArg: IAuthoritySocketPaths) => plugins.authswitch.AuthSwitchClient;
/**
 * The production pair, or `undefined` on a host that has none.
 *
 * The one call site is the controller entry point. Everything else -- every test, and the
 * controller itself -- receives endpoints rather than resolving them, so no code path can reach the
 * user's real authority without having been handed it.
 *
 * A misconfigured environment never disappears into that `undefined`: accounts stay unavailable
 * either way, but only one of the two cases is something the owner can fix, so it is reported the
 * way every other degraded startup condition is.
 */
export declare const resolveOptionalAuthoritySocketPaths: (reportArg?: (messageArg: string, errorArg: unknown) => void) => IAuthoritySocketPaths | undefined;
/** The snapshot shape this AGL reads. A daemon answering anything else is `schema_unsupported`. */
export declare const supportedAuthoritySchemaVersion: 2;