/**
 * Reserved FILE-BASED secrets bundle holding long-lived, non-rotating Claude
 * setup-tokens. Usage/probe reads authenticate with these instead of Claude
 * Code's ACL-bound login item, so they never pop Touch ID. Keyed strictly
 * per-account (`CLAUDE_CODE_OAUTH_TOKEN_<slug>` from the account email) — never a
 * bare key, so one account's token can't be misapplied to another in a
 * multi-account fleet.
 */
/** Alias of the secrets-layer reserved name so mint/seed shares one source of truth. */
export declare const AUTH_BUNDLE = "auth";
/** True only for a clean, single-line `sk-ant-oat01-…` token — see {@link SETUP_TOKEN_RE}. */
export declare function isValidClaudeSetupToken(value: string): boolean;
/** The per-account key an email maps to inside the `auth` bundle. */
export declare function claudeAccountTokenKey(account: string): string;
/** Signed-in account email for a version home, from `.claude.json` (no keychain). */
export declare function readClaudeAccountEmail(home?: string): string | null;
/**
 * Resolve a long-lived `claude setup-token` for the account signed into `home`
 * from the reserved FILE-BASED `auth` bundle. Returns the token or null. Reads
 * ONLY when the bundle is file-backed (never keychain), so this path itself can
 * never trigger a Touch ID prompt — that is the entire point: usage/probe reads
 * authenticate with the shareable setup-token, not the ACL-bound login item.
 */
export declare function resolveClaudeSetupToken(home?: string): string | null;
/**
 * Resolve a long-lived setup-token for an EXPLICIT account email, independent of
 * any version home's `.claude.json`. This is what lets `agents accounts attach`
 * provision a headless worker home that has never had an interactive login: the
 * account's non-rotating setup-token is already fleet-synced in the file-based
 * `auth` bundle, keyed by email ({@link claudeAccountTokenKey}), so we can write
 * the home's `.oauth_token` from it without the circular
 * "read the home's email to resolve the home's token" dependency that
 * {@link resolveClaudeSetupToken} has. Same file-backed-only, fail-closed,
 * fingerprint-stable read as the home-keyed path — it is the shared core.
 *
 * `cacheKey` scopes the process-local token cache; callers pass a version home
 * so a home-keyed and email-keyed read of the same account share nothing stale.
 */
export declare function resolveClaudeSetupTokenForEmail(email: string, cacheKey?: string): string | null;
/**
 * Seed a keychain-less Linux worker's Claude version-home identity so an account's
 * fleet-synced setup-token resolves for it. A worker home never had an interactive
 * browser login, so its `.claude.json` carries no `oauthAccount.emailAddress` and
 * the account reads "signed out" even though its non-rotating setup-token is present
 * in the `auth` bundle. This writes ONLY the descriptive identity (the email), merged
 * into both `.claude.json` locations Claude Code reads, preserving every other field.
 * It never copies a rotating OAuth credential (`.credentials.json`) — the setup-token
 * stays the credential of record.
 */
export declare function seedClaudeWorkerHomeIdentity(versionHome: string, email: string): void;
