/**
 * Secrets kept outside the profiles file.
 *
 * The profiles file gets copied, shown during debugging and committed by accident — a
 * password living there leaks with it. Secrets move to a file that is named as one, whose
 * permissions can be enforced the way ssh enforces them on private keys.
 */
/**
 * The shape the file must have. Carried into every error message, because the reader of a
 * failure is usually an agent that cannot go and look the format up.
 */
export declare const SECRETS_FILE_EXAMPLE = "{\n  \"<profile name>\": { \"password\": \"...\" },\n  \"<other profile>\": { \"passphrase\": \"...\" },\n  \"<third profile>\": { \"sudoPassword\": \"...\" }\n}";
/** Secrets for one profile */
export interface ProfileSecrets {
    password?: string;
    passphrase?: string;
    /** What `sudo` is answered with on the server, where that differs from the login password */
    sudoPassword?: string;
}
export interface SecretsFileProblem {
    /** Path as written in the profiles file, for the message to be recognizable */
    path: string;
    reason: string;
}
export type SecretsFileResult = {
    ok: true;
    secrets: Record<string, ProfileSecrets>;
} | {
    ok: false;
    problem: SecretsFileProblem;
};
/**
 * Resolve the path a profiles file points at.
 *
 * A relative path is taken from the profiles file, never from the process working
 * directory: the server is started by a client from wherever it likes, and the same config
 * would then mean different files on different runs.
 *
 * @param profilesFilePath - the already resolved path of the profiles file
 */
export declare function resolveSecretsPath(secretsFile: string, profilesFilePath: string): string;
/**
 * Read and validate a secrets file.
 *
 * Every failure is reported, never swallowed: a profile whose secret could not be read must
 * not quietly fall back to logging in without one.
 */
export declare function readSecretsFile(secretsFile: string, profilesFilePath: string): SecretsFileResult;