//#region src/hardening/apply.d.ts
/**
 * `applyProcessHardening(...)` - startup helper that:
 *
 *  - refuses to run as `root` on POSIX hosts (DEC-135);
 *  - sets `process.umask(0o077)` early so subsequent file creates
 *    inherit `0600` modes;
 *  - records the resolution as a structured event so the caller can
 *    forward to the audit log.
 *
 * The function is idempotent: calling it a second time with the same
 * options is a no-op (subject to `process.umask(...)` returning the
 * previous value).
 *
 * The host (the agent runtime in Phase 12 / the server in Phase 14)
 * calls this helper inside its `beforeStart` lifecycle hook. The CLI
 * (Phase 15) calls it at startup of every command that touches the
 * `~/.graphorin/` directory.
 *
 * @packageDocumentation
 */
/**
 * Options for `applyProcessHardening(...)`.
 *
 * @stable
 */
interface ApplyProcessHardeningOptions {
  /**
   * Refuse to run as root on POSIX hosts. Defaults to `true`. The
   * framework deliberately makes the safe path the default.
   */
  readonly refuseRoot?: boolean;
  /** Override the default umask (`0o077`). */
  readonly umask?: number;
  /**
   * Allow the framework to run as root even when `refuseRoot` is
   * `true`. Operators must opt in deliberately after reviewing
   * DEC-135.
   */
  readonly allowRoot?: boolean;
  /**
   * When the host process started with `--permission`, prefer
   * `fs.fchmod()` over `fs.chmod()` (CVE-2024-36137). The flag is
   * mostly informational here; downstream `ensureFileMode(...)`
   * reads the field via `getHardeningStatus(...)`.
   */
  readonly preferFchmod?: boolean;
  /** Optional WARN logger. */
  readonly warn?: (message: string) => void;
}
/**
 * Snapshot of the current hardening posture. Returned by
 * `applyProcessHardening(...)` and queryable later via
 * `getHardeningStatus(...)`.
 *
 * @stable
 */
interface HardeningStatus {
  readonly platform: NodeJS.Platform;
  readonly euid: number | undefined;
  readonly previousUmask: number;
  readonly umask: number;
  readonly refuseRoot: boolean;
  readonly preferFchmod: boolean;
  readonly appliedAt: number;
  /** True only after `applyProcessHardening` ran in this process. */
  readonly applied: true;
}
/**
 * Apply process-level hardening. The function returns the resolved
 * status so consumers can record it (e.g. forward to the audit log).
 * Calling it more than once returns the same status; the umask is
 * not changed on subsequent calls.
 *
 * @stable
 */
declare function applyProcessHardening(opts?: ApplyProcessHardeningOptions): HardeningStatus;
/**
 * Read the resolved hardening status. Returns `undefined` when
 * `applyProcessHardening(...)` has not been called yet.
 *
 * @stable
 */
declare function getHardeningStatus(): HardeningStatus | undefined;
/**
 * Reset internal state. Used by tests.
 *
 * @experimental
 */
declare function _resetHardeningStatusForTesting(): void;
//#endregion
export { ApplyProcessHardeningOptions, HardeningStatus, _resetHardeningStatusForTesting, applyProcessHardening, getHardeningStatus };
//# sourceMappingURL=apply.d.ts.map