export declare const RELAY_ORIGIN_CAPABILITY_BASENAME = ".botmux-origin-capability.json";
export declare const MANAGED_ORIGIN_ISOLATION_MARKER_BASENAME = ".botmux-read-isolated-v1";
export declare const MANAGED_ORIGIN_ISOLATION_SENTINEL_BASENAME = ".botmux-read-isolation-sentinel-v1";
export interface ManagedOriginCapabilityClaim {
    sessionId: string;
    channelId?: string;
    capability: string;
    turnId?: string;
    dispatchAttempt?: number;
    /** Current daemon port, host-written on every capability rotation. */
    ipcPort?: number;
}
/**
 * Per-session path used by macOS read-isolated CLIs to read only their own
 * rotating daemon-IPC capability. Hashing keeps an untrusted session id out of
 * the path while still letting the worker and CLI derive the same filename.
 * The parent is denied wholesale by the Seatbelt profile; only this exact file
 * is carved back in for the owning session.
 */
export declare function managedOriginCapabilityPath(dataDir: string, sessionId: string, channelId: string): string;
/**
 * Stable per-pane directory that can be mounted read-only into a
 * credential-only bwrap child. Binding the directory (instead of the file)
 * keeps atomic capability rotations visible while the hidden parent prevents
 * the child from enumerating another session's channel.
 */
export declare function managedOriginCapabilityDirectory(dataDir: string, sessionId: string, channelId: string): string;
/** Host-written, child-read-only proof directory for live daemon attestation. */
export declare function managedOriginAttestationDirectory(dataDir: string, sessionId: string, channelId: string): string;
export declare function managedOriginAttestationProofPath(dataDir: string, sessionId: string, channelId: string, nonce: string): string;
export declare function managedOriginIsolationMarkerPath(dataDir: string, sessionId: string, channelId: string): string;
export declare function managedOriginIsolationSentinelPath(homeDir: string): string;
export declare function ensureManagedOriginIsolationSentinel(homeDir: string): string;
/** Fixed-OS-home locator whose basename is covered by the legacy
 * `.dashboard-secret(?:\.|$)` read/write deny. New profiles carve only the
 * exact current-session leaf back in for reads while the final write deny
 * remains in force. This gives cmdSend a data-root binding independent of
 * mutable HOME/SESSION_DATA_DIR. */
export declare function managedOriginRootLocatorPath(osUserHomeDir: string, sessionId: string): string;
export interface ManagedOriginRootLocator {
    sessionId: string;
    dataDir: string;
}
/** Probe placed inside the locator-selected data root's legacy-denied
 * `read-isolation/` namespace, but outside every current exact carve-out. The
 * exact directory location matters: a forged sibling dataDir must not inherit
 * a parent-level dashboard-secret deny and masquerade as the real root. */
export declare function managedOriginDataRootProbePath(dataDir: string, sessionId: string): string;
export declare function ensureManagedOriginDataRootProbe(dataDir: string, sessionId: string): string;
export declare function managedOriginDataRootProbeAccess(dataDir: string, sessionId: string): 'host_accessible' | 'sandbox_denied' | 'missing_or_unsafe';
export declare function ensureManagedOriginRootLocator(osUserHomeDir: string, sessionId: string, dataDir: string): string;
export declare function readManagedOriginRootLocator(osUserHomeDir: string, sessionId: string): ManagedOriginRootLocator | null;
/** Kernel-observable macOS isolation classifier. The Seatbelt profile denies
 * this fixed, host-readable sentinel independent of env/argv/session ids. */
export declare function managedOriginIsolationSentinelAccess(homeDir: string): 'host_accessible' | 'sandbox_denied' | 'missing_or_unsafe';
/** Kernel probe backed by an inode that legacy read-isolation profiles already
 * denied: the dashboard HMAC secret. Only metadata is inspected; secret bytes
 * are never read or returned. This closes the upgrade race where a stale
 * pre-sentinel sandbox could replace a newly introduced probe path. */
export declare function managedOriginLegacyIsolationProbeAccess(osUserHomeDir: string): 'host_accessible' | 'sandbox_denied' | 'missing_or_unsafe';
/** Strict bounded reader for host-owned authority metadata. It never follows a
 * leaf symlink and opens FIFOs/devices nonblocking before rejecting them by
 * inode type, ownership, link count, mode, and size. */
export declare function readManagedOriginAuthorityFile(filePath: string, maxBytes?: number): string | null;
/** A durable, host-owned hint that this session was launched read-isolated.
 * It is deliberately separate from the rotating capability so missing,
 * corrupt, or revoked authority cannot silently downgrade `botmux send` to
 * the ordinary direct path. The marker is only a fail-closed classification
 * hint; the live daemon challenge remains the sole send authority. */
export declare function hasManagedOriginIsolationMarker(dataDir: string, sessionId: string, channelId: string): boolean;
/** Prepare the proof directory before Seatbelt canonicalizes its read carve. */
export declare function ensureManagedOriginAttestationDirectory(dataDir: string, sessionId: string, channelId: string): string;
/** Bounded owner-startup cleanup. Never call this from the unauthenticated
 * request path: a prefilled legacy directory must not turn every challenge
 * into an unbounded synchronous daemon scan. */
export declare function sweepManagedOriginAttestationProofs(dataDir: string, sessionId: string, channelId: string, maxEntries?: number): void;
export declare function replaceManagedOriginCapabilityFile(filePath: string, body: string): void;
/** Prepare a stable capability pathname without ever overwriting a successor
 * generation's regular file. Unsafe leaf types are removed by directory-entry
 * unlink (no follow); a regular leaf is left untouched for the daemon-owned
 * current-worker publication path. */
export declare function ensureManagedOriginCapabilityLeafSafe(filePath: string): void;
/**
 * Read the current origin claim from the per-session sandbox relay (Linux) or
 * the exact Seatbelt carve-out (macOS). A file is only transport: the daemon
 * still compares the token with its live worker registry, so stale files and
 * forged tuple fields never confer authority.
 */
export declare function readManagedOriginCapability(dataDir: string, sessionId: string | undefined, relayDir?: string, channelId?: string): ManagedOriginCapabilityClaim | null;
/**
 * Verify that the child-visible capability transport contains the exact token
 * currently authorized by the worker. Existence alone is insufficient: a
 * writable relay can contain a stale token, malformed JSON, or even a directory
 * at the reserved path after a prior sandbox generation.
 */
export declare function hasMatchingManagedOriginCapability(dataDir: string, sessionId: string | undefined, expectedCapability: string | undefined, relayDir?: string, channelId?: string): boolean;
//# sourceMappingURL=managed-origin-capability.d.ts.map