export declare const MAX_PI_AUTH_STORE_BYTES = 1048576;
export type PiAuthStoreUnsafeReason = "owner-check-unavailable" | "symbolic-link" | "not-regular-file" | "multiple-hard-links" | "oversized" | "foreign-owner" | "not-owner-only" | "changed-during-read" | "malformed-json" | "unreadable";
export type PiAuthStoreInspection = {
    readonly status: "ok";
    readonly auth: Readonly<Record<string, unknown>>;
} | {
    readonly status: "missing";
} | {
    readonly status: "unsafe";
    readonly reason: PiAuthStoreUnsafeReason;
};
/**
 * Inspect an existing Pi credential store without following aliases or reading
 * unbounded input. Credential discovery is deliberately stricter than the
 * explicit, locked repair flow: discovery accepts only a current-user,
 * owner-only, single-link regular file. The repair flow may read a
 * current-user, non-writable 0644 file under its exclusive lock solely so it
 * can atomically replace that file with a hardened 0600 store.
 */
export declare function inspectPiAuthStore(path: string): Promise<PiAuthStoreInspection>;
//# sourceMappingURL=pi-auth-store-inspection.d.ts.map