/**
 * Global-salt subsystem for the CLEO API key KDF.
 *
 * @task T348
 * @epic T310
 * @why ADR-037 §5 — API key KDF uses machine-key + global-salt + agentId.
 *      global-salt must persist across process restarts but is machine-local.
 * @what Atomic first-run generation, memoized read, permission/size validation.
 */
/** Filename for the global salt file under CLEO home. */
export declare const GLOBAL_SALT_FILENAME = "global-salt";
/** Required size of the global salt in bytes. */
export declare const GLOBAL_SALT_SIZE = 32;
/**
 * Returns the absolute path to the global-salt file.
 *
 * @returns Absolute path: `{cleoHome}/global-salt`
 *
 * @task T348
 * @epic T310
 *
 * @example
 * ```typescript
 * const saltPath = getGlobalSaltPath();
 * // Linux: "/home/user/.local/share/cleo/global-salt"
 * ```
 */
export declare function getGlobalSaltPath(): string;
/**
 * Returns the 32-byte global salt. Generates and persists atomically on first
 * call when the file does not exist. Subsequent calls return the memoized value.
 *
 * Never overwrites an existing salt — doing so would invalidate every stored
 * API key derived from it.
 *
 * @returns A 32-byte Buffer containing the global salt
 * @throws {Error} If the salt file exists with wrong size or wrong permissions
 *
 * @task T348
 * @epic T310
 *
 * @example
 * ```typescript
 * const salt = getGlobalSalt(); // Buffer(32) [...]
 * ```
 */
export declare function getGlobalSalt(): Buffer;
/**
 * Runtime validation helper for startup integrity checks.
 *
 * Throws if the salt file exists but is malformed (wrong size or permissions).
 * Safe to call when the file does not yet exist — returns silently in that case
 * because first-run generation is handled lazily by `getGlobalSalt()`.
 *
 * @throws {Error} If the salt file exists with wrong size or wrong permissions
 *
 * @task T348
 * @epic T310
 *
 * @example
 * ```typescript
 * // Called at process startup to catch accidental salt corruption early
 * validateGlobalSalt();
 * ```
 */
export declare function validateGlobalSalt(): void;
/**
 * Clears the in-process memoization cache so tests can exercise the
 * first-call generation path independently.
 *
 * @internal TEST ONLY — do NOT export through internal.ts or re-export
 * from any public barrel. This symbol must never appear in production call paths.
 *
 * @task T348
 * @epic T310
 */
export declare function __clearGlobalSaltCache(): void;
//# sourceMappingURL=global-salt.d.ts.map