import { type GatewayTrustedTurnIdentityProvider } from './gateway.js';
export interface SessionMcpGatewayHost {
    socketPath: string;
    socketDir: string;
    close(): Promise<void>;
}
/** Seatbelt deny for every Gateway socket directory owned by this OS user. */
export declare function sessionMcpGatewayPathRegex(socketRoot: string, uid?: number): string;
/** Deterministic per-session Gateway socket directory.
 *
 * The name is a pure function of (dataDir, sessionId) — NO random component —
 * so a replacement worker (daemon restart / upgrade) re-serves the socket at
 * the exact path a surviving persistent pane's relay already holds in its
 * environment, and the relay can simply reconnect instead of the worker having
 * to kill the pane and cold-resume the CLI.
 *
 * Stays under tmpdir (not dataDir) to keep the Unix socket below macOS's short
 * sun_path limit, and keeps the `bmcp-<uid>-` prefix so the existing Seatbelt
 * deny regex (sessionMcpGatewayPathRegex) covers it unchanged. The predictable
 * name is safe because ensurePrivateGatewayDir fails closed unless the
 * directory is a real 0700 directory owned by this uid — a squatter can only
 * DoS session startup, never observe traffic (connections still require the
 * rotating auth token). */
export declare function sessionMcpGatewaySocketDir(sessionId: string, dataDir: string): string;
/** Deterministic per-session Gateway socket path (see sessionMcpGatewaySocketDir). */
export declare function sessionMcpGatewaySocketPath(sessionId: string, dataDir: string): string;
/**
 * Serve a session's credential-bearing Gateway in the trusted worker process.
 * The CLI receives only a Unix socket capability and never reads the runtime
 * descriptor snapshot or plugin credentials itself.
 */
export declare function startSessionMcpGatewayHost(opts: {
    sessionId: string;
    dataDir: string;
    trustedTurnIdentity?: GatewayTrustedTurnIdentityProvider;
    onError?: (error: Error) => void;
}): Promise<SessionMcpGatewayHost>;
//# sourceMappingURL=host.d.ts.map