export declare const SEEDED_RUNTIME_AUTH_MANIFEST_NAME = "seeded-runtime-auth.json";
export type CredentialProvenanceOutcome = "seeded" | "missing" | "unsafe-source" | "unsafe-destination" | "unreadable-source" | "copy-failed";
export interface CodexCredentialSeedResult {
    outcome: CredentialProvenanceOutcome;
    /** Present only when outcome === "seeded". */
    sourcePath?: string;
    /** Present only when outcome === "seeded". */
    destinationPath?: string;
}
export interface CodexCredentialSource {
    /** Absolute path of the caller's regular auth.json file. */
    sourcePath: string;
    /** Absolute path inside the runtime home the copy was written to. */
    destinationPath: string;
}
export type CredentialSourceResolution = {
    status: "found";
    path: string;
} | {
    status: "missing";
} | {
    status: "unsafe";
};
/**
 * Resolve the caller's credential file path without following symlinks.
 * An explicit CODEX_HOME wins (same authority rule as codex-home.ts);
 * otherwise the user home (~/.codex) is used.
 */
export declare function resolveUserCredentialSource(env?: NodeJS.ProcessEnv): Promise<CredentialSourceResolution>;
/**
 * Back-compat helper: the caller's auth.json path when resolvable as a
 * regular file.
 */
export declare function resolveUserCredentialFilePath(env?: NodeJS.ProcessEnv): Promise<string | undefined>;
/**
 * Record seeded-credential provenance for a runtime home. Cleanup reads this
 * manifest to guarantee seeded copies are deleted (or at minimum never
 * persisted) even when history artifacts are retained for recovery.
 */
export declare function recordSeededRuntimeAuth(runtimeCodexHome: string): Promise<void>;
/**
 * Copy the caller's credential file into the ephemeral launch home.
 * Returns a typed outcome; callers must treat anything other than "seeded"
 * as "no credentials provided", never as success. The write is exclusive and
 * no-follow: a symlink already sitting at the destination aborts the seed
 * (outcome "unsafe-destination") instead of being followed.
 */
export declare function seedCredentialIntoRuntimeHome(runtimeCodexHome: string, env?: NodeJS.ProcessEnv): Promise<CodexCredentialSeedResult>;
//# sourceMappingURL=launch-credential-provenance.d.ts.map