declare const DEVICE_ISOLATION_MARKER_VERSION: 1;
interface DeviceIsolationMarker {
    version: typeof DEVICE_ISOLATION_MARKER_VERSION;
    /** pending still activates worker fail-closed masking, but cannot authorize
     * the first credential write until every daemon has quiesced legacy CLIs. */
    state: 'pending' | 'active';
    enabledAt: string;
    activatedAt?: string;
}
export declare class DeviceIsolationActivationError extends Error {
    constructor(message: string);
}
export interface DeviceIsolationActivationOptions {
    homeDir?: string;
    now?: () => Date;
}
/** Probe before writing the one-way marker; unsupported hosts refuse enroll. */
export declare function deviceCredentialIsolationSupported(platform?: NodeJS.Platform): boolean;
export declare function readDeviceCredentialIsolationMarker(options?: Pick<DeviceIsolationActivationOptions, 'homeDir'>): DeviceIsolationMarker | null;
/** Create the one-way PENDING marker durably. Pending already forces every new
 * local worker into credential isolation, but retries must still quiesce all
 * daemons before the marker may transition to ACTIVE. */
export declare function ensureDeviceCredentialIsolationMarker(options?: DeviceIsolationActivationOptions): {
    created: boolean;
    path: string;
    state: 'pending' | 'active';
};
/** Mark a fully quiesced host ACTIVE. This is the only state that lets a later
 * enroll skip the daemon transaction. The marker itself remains one-way. */
export declare function completeDeviceCredentialIsolationMarker(options?: DeviceIsolationActivationOptions): {
    path: string;
    state: 'active';
};
export {};
//# sourceMappingURL=device-isolation.d.ts.map