/**
 * Session-scoped relay authorization for Workflow v3 daemon mutations.
 *
 * A sandboxed (Linux bwrap) or read-isolated (macOS) chat CLI cannot use the
 * host mutation path: the process-tree markers, the run directory, and the
 * host `.dashboard-secret` are all masked by design, so
 * `authorizeV3DaemonCommand` + `postWorkflowDaemonMutation` fail before any
 * request leaves the sandbox. Instead of carving the global secret into the
 * sandbox (which would collapse the isolation boundary), the CLI presents its
 * per-turn rotating capability — the same aperture `/api/asks` already uses —
 * and this host-side module re-derives EVERY identity field from the daemon's
 * own live session record. The caller chooses nothing but the target runId
 * and the mutation payload; session/chat/caller identity is bound server-side.
 */
import type { WorkflowDaemonMutation } from './daemon-ipc-client.js';
export declare const V3_SESSION_RUN_MUTATION_ROUTE_PREFIX = "/api/v3/session-runs";
export declare const V3_SESSION_RUN_MUTATIONS: readonly ["start", "cancel", "retry", "grant"];
export declare function isV3SessionRunMutation(value: string): value is WorkflowDaemonMutation;
/** Live view of the claimed session, provided by the daemon's own registry. */
export interface V3SessionRelaySessionView {
    receiver: boolean;
    liveOrigin?: {
        capability: string;
        turnId?: string;
        dispatchAttempt?: number;
    };
    callerOpenId?: string;
    chatId?: string;
    larkAppId?: string;
    /** The session's CURRENT inbound turn pointer — advances the moment the next
     * message arrives, while liveOrigin only rotates when that message is
     * actually dequeued into the CLI. The generation join below compares them. */
    quoteTargetId?: string;
    /** Chat-scope fold-back turn pointer (currentReplyTarget.turnId), advanced
     * together with quoteTargetId. */
    currentReplyTargetTurnId?: string;
}
export type V3SessionRelayDecision = {
    ok: true;
    body: Record<string, unknown>;
    runDir: string;
    /** Owning bot from the run binding (== the daemon's own app id). */
    larkAppId: string;
} | {
    ok: false;
    status: number;
    error: string;
    detail?: string;
};
/**
 * Authorize one relayed mutation request. Deliberately pure: the daemon route
 * supplies the live session view and trusted-host flag, so the full
 * capability → session → run-binding chain is unit-testable without HTTP.
 */
export declare function authorizeV3SessionRunMutationRequest(input: {
    runId: string;
    mutation: string;
    /** Parsed JSON request body (untrusted). */
    raw: unknown;
    trustedHost: boolean;
    /** undefined when the claimed sessionId has no live session on this daemon. */
    session: V3SessionRelaySessionView | undefined;
    selfLarkAppId: string | undefined;
    baseDir: string;
}): V3SessionRelayDecision;
//# sourceMappingURL=session-relay.d.ts.map