export declare function adminTokenPath(dataDir: string): string;
/**
 * Generate a fresh random admin token and write it owner-only to disk. Called
 * once at daemon start — a new token per process means a token leaked to disk
 * from a prior run is invalid after a restart.
 */
export declare function ensureAdminToken(dataDir: string): string;
/**
 * Read the on-disk admin token. `doctor --fix` uses this to authenticate its
 * POST to a running daemon's reset route. Returns null when the file is absent,
 * unreadable, or blank (a blank token must never authenticate).
 */
export declare function readAdminToken(dataDir: string): string | null;
/**
 * Constant-time token comparison. Rejects null/empty on either side (a blank or
 * absent expected token must never match) before the length-safe compare.
 */
export declare function tokenMatches(expected: string | null, provided: string | null): boolean;
//# sourceMappingURL=admin-token.d.ts.map