export interface SshOrigin {
    clientIp: string;
    clientPort: number;
    serverIp: string;
    serverPort: number;
}
export interface MuxLocation {
    kind: 'tmux' | 'screen';
    /** tmux server socket path (first comma-field of $TMUX). Undefined for screen. */
    socket?: string;
    /** Exact pane id from $TMUX_PANE, e.g. '%3' — the send-keys target. */
    pane?: string;
    /** screen session name from $STY, e.g. '12345.pts-0.host'. */
    session?: string;
}
/** How the feed can type back into a session, derived from env rails that exist today. */
export type ReplyRail = {
    rail: 'tmux';
    target: string;
    socket?: string;
}
/** iTerm2 split addressed by its session UUID (the part of $ITERM_SESSION_ID after ':'). */
 | {
    rail: 'iterm';
    session: string;
} | null;
export interface SessionProvenance {
    /** Machine the process runs on — os.hostname(). Drives HOSTS grouping. */
    host: string;
    /** 'ssh' when SSH_CONNECTION is present in the process env, else 'local'. */
    transport: 'local' | 'ssh';
    /** Populated when transport === 'ssh'. */
    ssh?: SshOrigin;
    /** TERM_PROGRAM: 'iTerm.app', 'vscode', 'WezTerm', 'tmux', 'Apple_Terminal', … */
    term?: string;
    /** Multiplexer the process sits inside, from $TMUX / $STY. */
    mux?: MuxLocation;
    /** Whether an existing rail can type back into this session (see module doc). */
    reply: ReplyRail;
    /** The initiating device, resolved at query time from ssh.clientIp against the
     * device registry (ssh transport only). Answers "who launched this and from
     * where" without scraping ps/who/tailscale. */
    origin?: {
        device: string;
        user?: string;
    };
}
/** Env vars that carry provenance. Kept small so the macOS `ps` scan stays cheap. */
export declare const PROVENANCE_ENV_KEYS: readonly ["SSH_CONNECTION", "SSH_TTY", "TMUX", "TMUX_PANE", "TERM_PROGRAM", "STY", "ITERM_SESSION_ID"];
/**
 * Extract the iTerm2 session UUID from `$ITERM_SESSION_ID`, whose value is
 * `w<window>t<tab>p<pane>:<UUID>` — the `:`-suffix is exactly what iTerm2's
 * `id of session` returns, so it's the address for `tell session id …`. Returns
 * undefined for an empty/absent value; tolerates a bare value with no `:`.
 */
export declare function parseItermSession(value?: string): string | undefined;
/** Parse the NUL-separated body of /proc/<pid>/environ into a plain object. */
export declare function parseProcEnviron(buf: string): Record<string, string>;
/**
 * Pull known env vars out of a macOS `ps eww` command+env line. For each
 * `KEY=` match we consume the declared number of tokens (default 1), so
 * SSH_CONNECTION's internal spaces survive while a following unknown var
 * (e.g. `PWD=…`) is not swallowed into the previous value.
 */
export declare function extractKnownEnv(text: string, keys: readonly string[]): Record<string, string>;
/** `<client_ip> <client_port> <server_ip> <server_port>` → structured origin. */
export declare function parseSshConnection(value: string): SshOrigin | undefined;
/** Build a SessionProvenance from a raw env map + the local hostname. Pure. */
export declare function deriveProvenance(env: Record<string, string>, hostname: string): SessionProvenance;
/**
 * Resolve provenance for a live pid. Returns undefined when the process env
 * can't be read (process gone, foreign uid, unsupported platform) — we never
 * fabricate a 'local' answer we can't back with the env.
 */
export declare function detectProvenance(pid: number): Promise<SessionProvenance | undefined>;
