export type SeatLoginVerb = 'argv' | 'ingest' | 'status' | 'sign-out';
export type ExecLike = (file: string, args: string[], opts: {
    timeout: number;
    env: NodeJS.ProcessEnv;
}) => Promise<{
    stdout: string;
    stderr: string;
}>;
export interface SeatLoginDeps {
    exec?: ExecLike;
    gatewayDir?: string;
}
/** First-use `seat-login argv` builds the seat image (codex crew-r2). */
export declare const ARGV_TIMEOUT_MS: number;
/** The container seat floor is on, read exactly as the engine reads `WICKED_SEAT_FLOOR`
 *  (wicked-core `container_floor.rs`: trimmed, ASCII case-insensitive `container`), so crew's
 *  sign-in routes and roster never disagree with the engine about which floor is running. */
export declare function isContainerSeatFloor(env?: NodeJS.ProcessEnv): boolean;
/** Whether the interim HOST floor is chosen — the engine's own rule (`host_floor_chosen`,
 *  wicked-core#976): `WICKED_SEAT_FLOOR` set to anything but `container`, a typo included. Unset is
 *  neither floor (a daemon always sets one, {@link defaultSeatFloor}). */
export declare function isHostSeatFloor(env?: NodeJS.ProcessEnv): boolean;
/** The default seat floor of a crew daemon (C5): governed seats run in containers. Sets
 *  `WICKED_SEAT_FLOOR=container` in `env` unless the operator chose a floor — the engine (in this
 *  process) and crew's sign-in routes and roster then read the same value. `WICKED_SEAT_FLOOR=host`
 *  keeps the interim host floor (macOS Seatbelt / Linux bwrap), labelled as such. Returns the floor. */
export declare function defaultSeatFloor(env?: NodeJS.ProcessEnv): string;
export declare function isContainerLoginCli(cli: string): boolean;
/** The gateway dir spelled as the ENGINE spells it: the canonical state home (its `--db` parent,
 *  canonicalized) + `gateway`. The gateway's name hashes this path, so a symlinked spelling
 *  (macOS `/tmp` vs `/private/tmp`) would address a different gateway and broker. */
export declare function gatewayDirOf(dir: string): string;
/** The engine's gateway dir for the daemon whose store is `dbPath` (`<canonical db parent>/gateway`,
 *  as `execute_wrapped` arms it), shared by the roster's status cache and the sign-in routes
 *  (agy crew-r1: two derivations could address two gateways). */
export declare function seatLoginDepsFor(dbPath: unknown, exec?: ExecLike): SeatLoginDeps;
/** A seat-login diagnostic as it may cross the wire: its first line, the operator's home spelled
 *  `~`, bounded (agy crew-r1). The engine never prints a credential in one. */
export declare function loginDetail(text: string): string;
export declare function runSeatLogin(verb: SeatLoginVerb, cli: string, deps?: SeatLoginDeps): Promise<{
    rc: number;
    stdout: string;
    stderr: string;
}>;
export interface BrokerStatus {
    signed_in: boolean | null;
    /** `refresh_failing`: still signed in, but the broker's last refresh failed (DES §6). */
    state: 'signed_in' | 'signed_out' | 'expired' | 'refresh_failing' | 'unknown';
    expires_at?: number;
    reason?: string;
}
export declare function parseBrokerStatus(stdout: string): BrokerStatus;
export type BrokerReading = BrokerStatus & {
    probedAt: string;
};
/** Broker credentials belong to the gateway; roster reads must never inspect worker homes. */
export declare class SeatContainerStatus {
    private readonly deps;
    private readonly now;
    private readonly cache;
    private readonly inflight;
    private readonly generations;
    constructor(deps?: SeatLoginDeps, now?: () => number);
    read(cli: string): BrokerReading | undefined;
    invalidate(cli: string): void;
    refreshFresh(cli: string): Promise<BrokerReading>;
    refresh(cli: string): Promise<BrokerReading>;
}
//# sourceMappingURL=seat-container-login.d.ts.map