export declare const VC_MEETING_DAEMON_AUTH_HEADER = "x-botmux-vc-daemon-auth";
export interface VcMeetingDaemonAuthFailure {
    ok: false;
    status: 401;
    body: {
        ok: false;
        errorCode: 'vc_daemon_auth_required';
        error: string;
    };
}
export type VcMeetingDaemonAuthResult = {
    ok: true;
} | VcMeetingDaemonAuthFailure;
type HeaderMap = Record<string, string | string[] | undefined>;
/** Digesting the app id keeps arbitrary app-id characters out of filenames. */
export declare function vcMeetingDaemonAuthTokenPath(dataDir: string, larkAppId: string): string;
/** Read an existing target token without creating or rotating it. */
export declare function readVcMeetingDaemonAuthToken(dataDir: string, larkAppId: string): string | undefined;
/**
 * Create-once/read the target token. File locking prevents two daemon starts
 * from racing to install different credentials for the same app id.
 */
export declare function ensureVcMeetingDaemonAuthToken(dataDir: string, larkAppId: string): string;
/** Pure route guard result. Callers must invoke it before reading a body. */
export declare function authorizeVcMeetingDaemonControlRequest(dataDir: string, targetLarkAppId: string, headers: Headers | HeaderMap): VcMeetingDaemonAuthResult;
/** Add/replace the target daemon's credential without mutating caller headers. */
export declare function withVcMeetingDaemonAuthHeader(dataDir: string, targetLarkAppId: string, initHeaders?: HeadersInit): Headers;
export {};
//# sourceMappingURL=vc-meeting-daemon-auth.d.ts.map