import type { EnvironmentConfig, FactiiiConfig, Stage } from '../types/index.js';
/**
 * Write an SSH key to a file with correct permissions (cross-platform).
 * On Windows, uses icacls to restrict access since POSIX modes are ignored.
 */
export declare function writeSecureKeyFile(keyPath: string, keyContent: string): void;
/**
 * Find the SSH key path for a given stage under ~/.ssh/factiii/<project>/.
 * Returns null if the key doesn't exist or isn't a valid private key.
 */
export declare function findSshKeyForStage(stage: string, projectName: string): string | null;
/**
 * For prod, an explicit .pem path may be configured in stack.yml (aws.prod_ssh_key_path).
 * Returns the path if it exists and is a valid private key, else null.
 */
export declare function findProdPemKey(config: FactiiiConfig): string | null;
/**
 * Get the EnvironmentConfig for a given stage from stack.yml config.
 * Returns the first environment matching the stage.
 *
 * @param stage - The deployment stage (staging, prod)
 * @param config - Parsed stack.yml config
 * @returns EnvironmentConfig with domain and ssh_user, or null
 */
export declare function getEnvConfigForStage(stage: Stage, config: FactiiiConfig): EnvironmentConfig | null;
/**
 * Execute a command on a remote server via SSH
 * Falls back to sshpass with vault password when no SSH key exists.
 *
 * @param envConfig - Environment config with host and ssh_user
 * @param command - Command to execute
 * @param stage - Optional stage to use the correct SSH key (staging, prod)
 * @param config - Optional stack.yml config (needed for vault password fallback)
 * @param rootDir - Optional project root directory (for vault path resolution)
 * @returns Command output
 */
export declare function sshExec(envConfig: EnvironmentConfig, command: string, stage?: Stage, config?: FactiiiConfig, rootDir?: string): Promise<string>;
//# sourceMappingURL=ssh-helper.d.ts.map