/**
 * WS5.2 R12.i — the REAL cooperative data-plane wipe for AccountFollowMeRevocation.
 *
 * The pure executor (`AccountFollowMeRevocation`) takes a `cooperativeWipe(req) => CooperativeWipeResult`
 * dep — three booleans (loggedOut / slotDeleted / poolRemoved). This factory builds the PRODUCTION
 * implementation for a LOCAL account (the PER-SERVER model, OQ6: the operator revokes the mandate on
 * the TARGET machine's OWN dashboard, so the target runs its OWN local wipe — this is never a
 * cross-machine wipe-instruction).
 *
 * Per the spec (line 193) the wipe is three steps against the local account:
 *   1. logout    — the framework's own logout against that account's CLAUDE_CONFIG_DIR.
 *   2. slot del  — delete the per-account config-home directory + its keychain credential entry.
 *   3. pool rm   — SubscriptionPool.remove(accountId).
 *
 * FAIL-CLOSED CONTRACT (load-bearing): every step is wrapped so a throw becomes `false`, NEVER a
 * silent `true`. The executor treats a partial/all-false result as a durable pending retry — it
 * never claims `removed` it could not confirm. The whole function returns the per-step booleans;
 * it does NOT itself throw (the executor's catch is a backstop, but we resolve each step honestly).
 *
 * The two side-effecting primitives (framework logout, directory/keychain deletion) are injected so
 * this is unit-testable without spawning a real `claude` CLI or touching a real keychain; production
 * wiring passes the real execFileSync-backed logout + SafeFsExecutor-backed deletion.
 */
/**
 * Deletion-safety guard (BLOCKING fix, 2026-06-17 second-pass review): the cooperative wipe does a
 * `recursive,force` rm of an account's configHome. configHome is operator-provided at enroll time and
 * `~/.claude` (the operator's PRIMARY/shared login) is a legitimate value — so an `account-follow-me`
 * revoke targeting the default account would otherwise recursively delete the operator's main login
 * directory. This refuses to delete any catastrophic / shared target: a filesystem root, `$HOME`
 * itself, an ANCESTOR of `$HOME`, or a framework DEFAULT config home (`~/.claude`, `~/.codex`, …).
 * A refused path returns slotDeleted:false → the executor falls to a durable pending, NEVER a false
 * `removed`. A genuine per-account slot (e.g. `~/.claude-adriana`, `~/.instar/accounts/<id>`) is NOT
 * matched and deletes normally.
 */
export declare function isProtectedConfigHome(rawConfigHome: string): boolean;
import type { CooperativeWipeResult, RevocationRequest } from './AccountFollowMeRevocation.js';
import type { SubscriptionPool } from './SubscriptionPool.js';
export interface CooperativeWipeDeps {
    pool: SubscriptionPool;
    /**
     * Run the framework's logout against the account's config home. MUST return true ONLY on a
     * confirmed logout; false (or throw) otherwise. Injected for tests; production uses execFileSync.
     */
    frameworkLogout?: (args: {
        framework: string;
        configHome: string;
    }) => boolean;
    /**
     * Delete the per-account config-home directory + its keychain credential entry. MUST return true
     * ONLY when the slot is gone; false (or throw) otherwise. Injected for tests; production uses
     * SafeFsExecutor + `security`.
     */
    deleteSlot?: (args: {
        configHome: string;
        framework: string;
    }) => boolean;
    log?: (msg: string) => void;
}
/**
 * Build the production `cooperativeWipe` function for the injected SubscriptionPool. The returned
 * function reads the LOCAL account's config home + framework from the pool (the operator-revoked
 * account on THIS machine) and runs the three steps. If the account is not found locally, every
 * step is false (nothing to wipe here — the executor falls to pending, honest).
 */
export declare function buildCooperativeWipe(deps: CooperativeWipeDeps): (req: RevocationRequest) => CooperativeWipeResult;
//# sourceMappingURL=accountFollowMeCooperativeWipe.d.ts.map