//#region src/hardening/doctor.d.ts
/**
 * `graphorin doctor` library functions. Each helper returns a
 * `CheckResult[]` with structured `status` (`'ok' | 'warn' | 'fail'`)
 * + remediation hint. The CLI binary in Phase 15 wraps these helpers
 * as the `graphorin doctor` subcommands.
 *
 * The helpers do not write to disk - they only read. `--fix-perms`
 * is implemented in the CLI by calling `ensureFileMode(...)` /
 * `ensureDirMode(...)` after `checkPerms(...)` reports a drift.
 *
 * References:
 *  - DEC-135 - process hardening (file modes, refuse-as-root).
 *  - DEC-136 - secrets capability matrix
 *    (`getSecretsStoreStatus(...)`).
 *  - DEC-129 - encryption-at-rest opt-in (audit-db binding).
 *
 * @packageDocumentation
 */
/**
 * Discriminator for individual check outcomes.
 *
 * @stable
 */
type CheckStatus = 'ok' | 'warn' | 'fail' | 'skip';
/**
 * One result row produced by the doctor library.
 *
 * @stable
 */
interface CheckResult {
  readonly check: string;
  readonly status: CheckStatus;
  readonly message: string;
  readonly hint?: string;
}
/**
 * Options for `checkPerms(...)`.
 *
 * @stable
 */
interface CheckPermsOptions {
  /**
   * Map of path → expected POSIX mode. Each entry is checked
   * against `lstat`. Missing files surface as `'warn'` so the
   * doctor can recommend `graphorin init`.
   */
  readonly expected: Readonly<Record<string, number>>;
}
/**
 * Verify that a set of paths carry the expected POSIX modes. Used
 * by `graphorin doctor --check-perms`.
 *
 * @stable
 */
declare function checkPerms(opts: CheckPermsOptions): Promise<CheckResult[]>;
/**
 * Wrapper around `getSecretsStoreStatus(...)` from the secrets
 * subsystem. Surfaces any active downgrade as a `'warn'` and
 * `--strict-secrets` failure as `'fail'`.
 *
 * @stable
 */
declare function checkSecrets(): CheckResult[];
/**
 * Verify that an encrypted-SQLite binding is registered for the
 * audit log. The framework refuses to open the audit log without an
 * encrypted binding, so the doctor surfaces the missing binding as
 * `'fail'` - unless the supplied config has the audit log DISABLED, in
 * which case the binding is not required and the check reports `'skip'`
 * (a fresh `init --no-encrypted` + `doctor --all` must not fail on a
 * subsystem the config turned off).
 *
 * @stable
 */
declare function checkEncryption(options?: {
  readonly auditEnabled?: boolean;
  readonly bootstrapped?: boolean;
}): CheckResult[];
/**
 * Linux-only systemd hardening check. Returns a `'skip'` row on
 * non-Linux hosts. The body parses the structured output of
 * `systemd-analyze security <unit>`; the parser is intentionally
 * thin so deployments without systemd report a clean skip.
 *
 * @stable
 */
declare function checkSystemd(opts: {
  readonly unit?: string;
  readonly run?: (command: string) => Promise<string>;
}): Promise<CheckResult[]>;
/**
 * Parse the score line from `systemd-analyze security`. The line
 * normally looks like `→ Overall exposure level for ...: 7.4 OK`.
 *
 * @stable
 */
declare function parseSystemdScore(output: string): number | undefined;
//#endregion
export { CheckPermsOptions, CheckResult, CheckStatus, checkEncryption, checkPerms, checkSecrets, checkSystemd, parseSystemdScore };
//# sourceMappingURL=doctor.d.ts.map