import type { EnvSnapshot } from "./env-snapshot.js";
export type DaemonConfigV1 = {
    version: 1;
    token: string;
    port: number;
    env: EnvSnapshot;
    installedAt: string;
};
export type DaemonConfigV2 = {
    version: 2;
    token: string;
    tokens: string[];
    port: number;
    env: EnvSnapshot;
    installedAt: string;
};
export type DaemonConfig = DaemonConfigV1 | DaemonConfigV2;
export declare function resolveDaemonConfigPath(env: Record<string, string | undefined>): string;
export declare function normalizeDaemonToken(raw: string): string;
export declare function normalizeDaemonTokens(raw: unknown): string[];
export declare function daemonConfigPrimaryToken(config: DaemonConfig): string;
export declare function daemonConfigTokens(config: DaemonConfig): string[];
/**
 * Constant-time check that `candidate` matches one of the configured tokens.
 *
 * `Array.prototype.includes` short-circuits on `===` (both per-token and
 * per-character), so the time it takes to reject a guess leaks how much of a
 * configured token matched. We compare every configured token, using
 * `crypto.timingSafeEqual` for each, so the running time depends only on the
 * number of configured tokens — never on the candidate's content.
 */
export declare function isAuthorizedDaemonToken(candidate: string, tokens: readonly string[]): boolean;
export declare function normalizeDaemonPort(raw: unknown): number;
export declare function readDaemonConfig({ env, }: {
    env: Record<string, string | undefined>;
}): Promise<DaemonConfig | null>;
export declare function writeDaemonConfig({ env, config, }: {
    env: Record<string, string | undefined>;
    config: Omit<DaemonConfigV2, "version" | "installedAt"> & Partial<Pick<DaemonConfigV2, "installedAt">>;
}): Promise<string>;
