export interface TrustedReadonlyFileIdentity {
    realPath: string;
    dev: number;
    ino: number;
    size: number;
    mtimeMs: number;
}
export interface TrustedReadonlyPosixFacts {
    currentUid: number;
    fileUid: number;
    fileMode: number;
    fileWritable: boolean;
    parents: Array<{
        uid: number;
        mode: number;
        writable: boolean;
    }>;
}
export declare function trustedReadonlyPosixFactsIssue(facts: TrustedReadonlyPosixFacts): string | null;
export declare function registerTrustedReadonlyFileForTest(file: string): () => void;
/**
 * Proves that a trust-anchor file cannot be replaced or modified by the
 * current process. POSIX proof requires a different owner and a complete
 * non-writable parent chain. Windows must use a host-provided read-only mount
 * capability until ACL proof is available.
 */
export declare function assertTrustedReadonlyFile(options: {
    file: string;
    previous?: TrustedReadonlyFileIdentity;
}): Promise<TrustedReadonlyFileIdentity>;
//# sourceMappingURL=trusted-readonly-file.d.ts.map