/**
 * Filesystem layout for the managed meta-proxy binary (ADR-307), all under
 * the same `~/.ruflo` state dir every other funnel/proxy/auth file uses
 * (src/funnel/state.ts's `funnelStateDir()` — respects RUFLO_STATE_DIR for
 * tests). Centralized here so doctor.ts, install.ts, and lifecycle.ts share
 * one definition instead of three copies drifting apart.
 */
export declare function proxyBinaryPath(): string;
export declare function proxyPidFilePath(): string;
export declare function proxyLockFilePath(): string;
export declare function proxyLogFilePath(): string;
export declare function proxyInstallManifestPath(): string;
export declare function proxyConfigPath(): string;
export declare function proxyTokenPath(): string;
export declare function proxyInjectedTokenPath(): string;
export interface InstallManifest {
    version: string;
    sha256: string;
    verifiedAt: string;
    pubkeyFingerprint: string;
}
/**
 * True if `bind` (a `host:port` string from proxy-config.toml) targets a
 * loopback address — decides whether the non-loopback exposure warning
 * fires (ADR-307). Recognizes the whole IPv4 127.0.0.0/8 block, IPv6 `::1`,
 * IPv4-mapped IPv6 loopback, and the `localhost` hostname.
 *
 * A plain `bind.startsWith('127.0.0.1')` check (the obvious first draft)
 * misclassifies `[::1]:port` as non-loopback — a real bug meta-proxy's own
 * Rust `is_loopback_bind` fixed for the identical reason; this mirrors that
 * fix rather than repeating the mistake on the TypeScript side.
 */
export declare function isLoopbackBind(bind: string): boolean;
//# sourceMappingURL=paths.d.ts.map