/**
 * 接続先ホストが呼び出し時点で判明しない経路専用の共有 sshHostId。
 * terminal-session の対話シェル、git-credential-setup の未登録ホストへの
 * フォールバック等で使う。sanitizeNameSegment 通過後も 'shared' のまま。
 */
export declare const GENERAL_KNOWN_HOSTS_ID = "shared";
/** Directory (under the persistent config dir) holding one known_hosts file per (tenantCode, sshHostId) pair. */
export declare function knownHostsDir(): string;
/**
 * Resolve (and ensure exists) the persistent known_hosts file path for a
 * given tenant/host pair.
 *
 * Creates an empty file (mode 0600 — not secret, but kept restrictive like
 * the rest of this directory's contents) the first time a given tenant/host
 * pair is seen; that first run is TOFU's legitimate "trust on first use".
 * Every subsequent run against the same host reuses (and lets `ssh` append
 * to) the same file, so a later host-key change is detected — via ssh's own
 * `StrictHostKeyChecking=accept-new` behavior — rather than silently
 * accepted.
 */
export declare function resolveKnownHostsPath(tenantCode: string, sshHostId: string): string;
//# sourceMappingURL=known-hosts-store.d.ts.map