/**
 * Profiles File Loader
 * Load SSH profiles from JSON configuration file
 */
import { type StrictHostKeyChecking } from './ssh-config.js';
import type { PathSecurityConfig } from './path-validator.js';
/**
 * A rejected profile: its name, the offending field, the value it held, and why it's bad.
 *
 * A parsed record rather than a ready-made string: the rejection is looked up
 * where a profile is requested by name, and it composes its own message there.
 */
export interface BrokenProfile {
    /** Profile name in the file */
    name: string;
    /** Field that caused the profile to be rejected */
    field: string;
    /** Field value as it was written in the file */
    value: string;
    /** Why the value doesn't work */
    reason: string;
    /**
     * What a correct value looks like, printed after the reason.
     *
     * The reader of a rejected profile is usually an agent with no way to go and look the
     * format up, so the message carries it.
     */
    hint?: string;
}
/** One rejection line: profile, field, reason, and what was in the file */
export declare function describeBrokenProfile(entry: BrokenProfile): string;
/**
 * Profiles configuration file structure
 */
interface ProfilesConfig {
    /** Secrets file used by every profile that does not name its own */
    secretsFile?: string;
    /** SSH profiles by name */
    profiles: Record<string, SSHProfileData>;
}
/**
 * SSH profile data in config file
 */
export interface SSHProfileData {
    /** Server address (required) */
    host?: string;
    /** Username for SSH connection (required) */
    username?: string;
    /** SSH port (default: 22) */
    port?: number;
    /** Path to private SSH key */
    privateKeyPath?: string;
    /** Passphrase for encrypted SSH key */
    passphrase?: string;
    /** Password for authentication (not recommended for production) */
    password?: string;
    /**
     * What `sudo` is answered with on the server.
     *
     * A profile that logs in by key has no login password to offer, and where the two
     * differ the login one is the wrong answer. Left out, `password` is used.
     */
    sudoPassword?: string;
    /**
     * Where this profile's password and passphrase are kept, instead of in this file.
     * Overrides the file-level `secretsFile`. A relative path is taken from the profiles file.
     */
    secretsFile?: string;
    /** Host key checking policy: yes | accept-new | no (default: accept-new) */
    strictHostKeyChecking?: StrictHostKeyChecking;
    /** Ignore the user's ~/.ssh/config for this profile */
    ignoreUserConfig?: boolean;
    /** Path restrictions: allowed and denied directory lists */
    pathSecurity?: PathSecurityConfig;
}
/**
 * Result of loading profiles file
 */
export interface ProfilesFileResult {
    /** Loaded profiles configuration */
    config: ProfilesConfig | null;
    /** Validation errors */
    errors: string[];
    /** Profiles rejected because of a broken field */
    broken: BrokenProfile[];
}
/**
 * Load profiles from JSON file
 *
 * @param filePath - Path to profiles JSON file
 * @returns Profiles configuration and errors
 */
export declare function loadProfilesFile(filePath: string): ProfilesFileResult;
export {};