/**
 * Build a route- and port-bound authorization header for the daemon's
 * loopback HTTP server.  Loopback is connectivity, not identity: Linux bwrap
 * sessions normally retain the host network namespace so an untrusted CLI can
 * also dial 127.0.0.1.  The shared dashboard secret is masked from file
 * sandboxes, while trusted dashboard/daemon/host-CLI callers can read it.
 */
export declare function daemonIpcAuthHeaders(input: {
    secret: string;
    port: number;
    method: string;
    path: string;
    headers?: HeadersInit;
}): Headers;
/** Read the host-only daemon IPC secret. Sandboxed callers fail closed because
 * ~/.botmux is masked by the bwrap plan. */
export declare function loadDaemonIpcSecret(secretPath?: string): string;
/** Trusted-host fetch wrapper for daemon IPC. */
export declare function fetchDaemonIpc(port: number, path: string, init?: RequestInit, secret?: string): Promise<Response>;
//# sourceMappingURL=daemon-ipc-auth.d.ts.map