//#region src/hardening/file-modes.d.ts
/**
 * POSIX file-mode utilities. The framework uses `0700` on
 * `~/.graphorin/` and `0600` on every sensitive file inside.
 * `ensureFileMode(...)` and `ensureDirMode(...)` apply the mode and
 * verify the post-condition; `verifyFileMode(...)` is a read-only
 * check used by `graphorin doctor` (Phase 15).
 *
 * The helpers prefer `fs.fchmod()` when the host process started
 * with `--permission` (CVE-2024-36137) per DEC-135.
 *
 * On Windows the helpers degrade to no-ops with a WARN since POSIX
 * modes are not honoured by NTFS. The doctor surfaces this gap and
 * recommends FDE.
 *
 * References:
 *  - DEC-135 - process hardening (mandatory POSIX modes).
 *
 * @packageDocumentation
 */
/**
 * Ensure a file is at the supplied POSIX mode. The function:
 *
 *  - On Windows / non-POSIX hosts, calls `warn(...)` and returns.
 *  - Else opens the file, runs `fchmod` if the process started with
 *    `--permission`, otherwise plain `chmod`.
 *  - Verifies the mode via `lstat` and throws
 *    `FileModeMismatchError` if the post-condition fails.
 *
 * @stable
 */
declare function ensureFileMode(path: string, mode: number, opts?: {
  readonly warn?: (message: string) => void;
}): Promise<void>;
/**
 * Ensure a directory exists at the supplied POSIX mode. Creates the
 * directory recursively when it does not exist.
 *
 * @stable
 */
declare function ensureDirMode(path: string, mode: number, opts?: {
  readonly warn?: (message: string) => void;
}): Promise<void>;
/**
 * Read the current POSIX mode and report whether it matches.
 *
 * @stable
 */
declare function verifyFileMode(path: string, expected: number): Promise<{
  readonly ok: boolean;
  readonly actual: number;
}>;
//#endregion
export { ensureDirMode, ensureFileMode, verifyFileMode };
//# sourceMappingURL=file-modes.d.ts.map