/**
 * Injectable IO for tests: `home` replaces `os.homedir()` and `env` replaces `process.env`,
 * so fixture dirs built with `mkdtemp` exercise every branch without touching the developer's
 * real dotfiles. Production callers omit it.
 */
export interface SigninProbeIo {
    home?: string;
    env?: Record<string, string | undefined>;
}
/**
 * Whether a credential file's CONTENT carries a credential (F-A45-006): a JSON object (or array)
 * holding, at any depth ≤ 4, a NON-EMPTY string under a key that names a secret (`key`, `token`,
 * `access`/`refresh`, `OPENAI_API_KEY`, …). The fresh rig's pi `auth.json` was `{}` — present, and
 * every ballot failed "No API key found" — so PRESENCE alone is not a sign-in: `{}`, `[]`, a type
 * marker with no secret (`{"type":"api_key"}`), malformed JSON and an empty file all read `false`.
 */
export declare function hasCredentialShape(raw: string): boolean;
/**
 * Cheap signed-in presence for one seat. `workerConfigRoot` is the settings-applied
 * `WICKED_WORKER_HOME` value when set (the roster route passes the live env, which is exactly
 * what the engine will read at the next spawn); omitted = the engine default `~/.wicked-worker`.
 *
 * Never throws: an unreadable file or dir is treated as the corresponding "not observable"
 * answer for that seat's rule, never a 500 on the roster route.
 */
export declare function signedInHeuristic(seatKey: string, workerConfigRoot?: string, io?: SigninProbeIo): boolean | null;
/**
 * The `WICKED_WORKER_HOME` this process BOOTED with — captured at module load, before any
 * settings application can rewrite it. This is what an unset/empty `worker_config_root` restores:
 * an operator who exported the variable before starting the daemon keeps their choice (the engine
 * would have honoured it had crew never touched the env), and the test harness's hermetic arming
 * (tests/setup/hermetic-home.ts, crew#396) survives every `createServer` boot over an empty
 * settings store — the unconditional delete this replaces re-aimed every subsequent worker spawn
 * at the operator's REAL `~/.wicked-worker`.
 */
export declare const BOOT_WORKER_HOME: string | undefined;
/**
 * Apply the persisted `worker_config_root` setting to THIS process's environment. The engine
 * reads `WICKED_WORKER_HOME` per worker spawn (acp_runner.rs — never cached at engine start),
 * so calling this at daemon boot and again on every settings change is sufficient: the next
 * spawn sees the new root with no daemon or engine restart. `settings.json` is the source of
 * truth when it names a root; unset/empty restores the env this process booted with
 * (`BOOT_WORKER_HOME`), falling back to deleting the variable (engine default
 * `~/.wicked-worker`) when the process booted without one.
 *
 * `fallback` exists so a unit test can exercise the booted-without-one branch in a process whose
 * baseline is armed; production callers never pass it. Pass `''` for "booted without one" — an
 * explicit `undefined` re-selects the default parameter (JS semantics), it does not override it.
 */
export declare function applyWorkerConfigRoot(root: string | undefined, fallback?: string | undefined): void;
//# sourceMappingURL=seat-signin.d.ts.map