export declare const MANAGED_ORIGIN_ATTEST_ROUTE = "/api/session-origin/attest";
export declare const MANAGED_ORIGIN_PROOF_DOMAIN = "botmux.managed-origin-attestation.v1";
export declare const MANAGED_ORIGIN_PROOF_TTL_MS = 5000;
export interface ManagedOriginAttestationContext {
    sessionId: string;
    channelId: string;
    capability: string;
    dataDir: string;
    /** Routing hints only; the daemon derives identity from its live registry. */
    larkAppId?: string;
    ipcPortFallback?: number;
}
export interface ManagedOriginAttestation {
    sessionId: string;
    turnId: string;
    dispatchAttempt?: number;
    requiresCodexAppLedger: boolean;
}
export interface ManagedOriginAttestationProof extends ManagedOriginAttestation {
    domain: typeof MANAGED_ORIGIN_PROOF_DOMAIN;
    version: 1;
    nonce: string;
    channelId: string;
    issuedAtMs: number;
}
export declare class ManagedOriginAttestationError extends Error {
    constructor(message: string, options?: ErrorOptions);
}
/** Daemon-side proof creation. The nonce is strict and the destination is
 * derived only from the authenticated session + daemon data root. O_EXCL and
 * O_NOFOLLOW make a pre-existing leaf fail closed rather than follow it. */
export declare function writeManagedOriginAttestationProof(input: {
    dataDir: string;
    proof: ManagedOriginAttestationProof;
}): string;
/**
 * Exchange a rotating capability for a host-file proof of the daemon's exact
 * live tuple. HTTP is transport only: a stale child can bind a released port
 * and forge a response, but Seatbelt prevents it from creating the random
 * nonce proof in the host-owned read-only directory.
 */
export declare function attestManagedOrigin(input: {
    context: ManagedOriginAttestationContext;
    resolveIpcPort?: (larkAppId: string | undefined) => number | undefined;
    fetchImpl?: typeof fetch;
    timeoutMs?: number;
    nonce?: string;
    now?: () => number;
    wait?: (delayMs: number) => Promise<void>;
}): Promise<ManagedOriginAttestation>;
//# sourceMappingURL=managed-origin-attestation.d.ts.map