/**
 * Tell a Fabric-owned pi-durable child's session that it is a worker.
 *
 * A context-aware extension reads `sessionRole` from `context-aware.policy.v1` custom
 * entries on the active branch of the session record, replaying them in order
 * (a later entry wins per path). Without one it behaves as a session with a user
 * at a terminal (compaction seed sent as a user message, model rewrite, cache
 * listing, mid-reply compaction). Delegation extensions write the same entry for their
 * workers. Fabric imports neither, so the wire shape is restated here
 * as plain JSON. This module uses node:fs only: the worker process must not load
 * the Pi SDK.
 *
 * Design: create complete, never edit. Fabric writes the entry only into a
 * session file it creates, in the same write that creates the file, as the ROOT
 * of the tree (the first entry after the header, `parentId: null`). Every entry
 * Pi appends, and every branch a later navigation or fork reaches, then descends
 * from it. The worker never appends to, rewrites, or parses an existing session
 * file, and a caller-supplied session file is never written at all.
 *
 * Threat model: a process running as the same user is trusted, because it can
 * already write every session file; same-user races (swapping a folder, adding
 * a hard link between a check and a write) are out of scope. This module guards
 * against other users and accidental links: before it creates anything it
 * requires the run directory to be a real directory owned by this user, removes
 * group and other write from it, and creates the folder without following links.
 */
export declare const DURABLE_WORKER_POLICY_ENTRY_TYPE = "context-aware.policy.v1";
export declare const DURABLE_WORKER_DECLARED_BY = "pi-fabric/durable-worker";
/** The one builder for the worker-role entry: plain JSON, shared by the durable-session writer and the seed writers. */
export declare const workerRoleEntry: (id: string, parentId: string | null, timestamp: string) => {
    type: string;
    customType: string;
    data: {
        schemaVersion: number;
        layer: string;
        declaredBy: string;
        values: {
            sessionRole: string;
        };
    };
    id: string;
    parentId: string | null;
    timestamp: string;
};
/** The structural slice of a Pi `SessionManager` that `declareWorkerSessionRole` needs. */
export interface WorkerRoleSessionManager {
    appendCustomEntry(customType: string, data?: unknown): unknown;
    getBranch(): ReadonlyArray<{
        type: string;
        customType?: string;
        data?: unknown;
    }>;
}
/**
 * For an embedding host that owns its session: add the worker-role entry to an open
 * `SessionManager` before the first prompt. It appends, so call it on a new session if
 * the entry should be the tree root. Idempotent: returns "already-seeded" when an entry
 * on the active branch most recently declares the worker role, and "seeded" after writing one.
 */
export declare const declareWorkerSessionRole: (sessionManager: WorkerRoleSessionManager) => "seeded" | "already-seeded";
/** An entry id Pi would accept (8 hex characters) that no existing entry uses. */
export declare const freshEntryId: (taken: ReadonlySet<string>) => string;
/**
 * Create the durable child's private session file, or reuse the existing one.
 *
 * Nothing is created unless the run directory is a real directory owned by this
 * user; group and other write are removed from it first. The folder is created under the existing
 * run directory without following links. A new file appears already complete (Pi
 * header, then the worker-role entry as the tree root): the content goes to
 * `tmp-<uuid>.jsonl` in the same folder (exclusive create, no link following),
 * is synced, then hard-linked to `session.jsonl`. Exactly one concurrent creator
 * wins the link; the others validate the winner's file. Existing files must be
 * regular, owned by this user and have no external hard links; their permissions
 * are tightened to 0600 if necessary, without changing their content. A crash
 * leaves at most a stray `tmp-<uuid>.jsonl`, possibly as a
 * second name for `session.jsonl`; a relaunch removes it and run retention
 * reclaims the pair with the run.
 */
export declare const createDurableSessionFile: (runDirectory: string, cwd: string, hooks?: {
    beforeLink?: () => void;
}) => string;
//# sourceMappingURL=worker-role-seed.d.ts.map