/**
 * Lock a file or directory down to the current user (+ SYSTEM + Administrators) only.
 *
 * POSIX: `chmod` (0o600 file / 0o700 dir) — a belt-and-braces reassert of the create-time mode.
 * win32: harden the NTFS ACL with `icacls`: `/inheritance:r` drops inherited ACEs; `/remove:g` drops
 * any pre-existing EXPLICIT broad grant (Everyone / Authenticated Users / Users) that `/grant:r`
 * alone would leave intact (e.g. on a pre-planted or pre-existing target); `/grant:r` then sets ONLY
 * the owner SID (`whoami /user`), SYSTEM (`S-1-5-18`), and Administrators (`S-1-5-32-544`). Removing
 * broad grants this way — rather than adding deny ACEs, which can catch the owner through group
 * membership — is the documented-safe pattern. Numeric SIDs are `*`-prefixed; the tools resolve from
 * `%SystemRoot%` and run shell-free. A directory grants `(OI)(CI)` so children inherit the private
 * ACE. FAIL-CLOSED: any `whoami`/`icacls` failure throws.
 */
export declare function hardenPrivate(path: string, kind: "file" | "dir"): void;
/**
 * Write a private secret file: the bytes (mode 0o600 at create on POSIX), then {@link hardenPrivate}
 * for the win32 ACL. FAIL-CLOSED — if hardening throws, the hardening error propagates (the caller
 * never proceeds as if the secret were safe) and the just-written file is best-effort deleted so it
 * isn't left readable.
 */
export declare function writeSecretFile(path: string, data: string | Buffer): void;
/**
 * Like {@link writeSecretFile} but ATOMIC: write a private temp sibling (same 0o600 + win32-ACL
 * hardening), then rename it over the target. `renameSync` is an atomic replace on POSIX and via
 * `MoveFileEx(REPLACE_EXISTING)` on Windows, so a concurrent reader never sees a torn/partial file and
 * a crash mid-write leaves the previous file intact. Use this for a read-modify-write of a shared secret
 * file (e.g. the IdP session cache). NB: this closes torn-file/partial-write hazards; a lost update
 * under two truly-concurrent writers to the same file is a rarer residual that would need file locking.
 */
export declare function writeSecretFileAtomic(path: string, data: string | Buffer): void;
/** Test-only: drive the `link`-unavailable fallback, which no POSIX CI host can reach naturally.
 *  Pass `undefined` to restore. Not exported from the package index. */
export declare function __setPublishLinkForTest(fn: ((from: string, to: string) => void) | undefined): void;
/**
 * Create a private secret file that MUST NOT already exist. Bytes are written to a unique temp
 * sibling first, then {@link linkSync} publishes that complete inode at `path`. `link` is an
 * atomic filesystem primitive: it fails with EEXIST if the destination exists, so of N concurrent
 * creators exactly one succeeds and the others observe EEXIST. A concurrent reader never sees a
 * torn destination because the name appears only after the temp write finished.
 *
 * `renameSync` is NOT this function. Rename replaces a winner, which would let every caller keep
 * the identity it minted in memory. Exclusive create is the mutual-exclusion primitive; atomic
 * replace is not.
 *
 * When the filesystem cannot hard-link (some Windows volumes), the fallback is `wx`
 * (`O_CREAT|O_EXCL`) on `path` itself, which is still exclusive create, not a replace.
 *
 * The TEMP write is exclusive for the same reason the publish is. A temp name is unique only by
 * probability (pid plus clock plus `Math.random`), and probability is not a concurrency argument:
 * two creators that collided on the name would plain-overwrite each other's bytes, and then the
 * one whose `link` succeeded would return the candidate IT minted while the published file held
 * the OTHER one's identity: the exact split this function exists to prevent, reintroduced one
 * step earlier. `wx` on the temp makes a collision fail loudly instead of silently swapping bytes.
 */
export declare function writeSecretFileCreateOnly(path: string, data: string | Buffer): void;
/** Create a private directory chain (recursive) and harden it — call BEFORE writing secrets into it
 *  so a child file is born under a private ACL (no creation-race window). POSIX sets 0o700 at create;
 *  win32 hardens the leaf's ACL (children then inherit it). Idempotent. */
export declare function mkSecretDir(path: string): void;
//# sourceMappingURL=secret-fs.d.ts.map