/**
 * Environment Setup Utility
 * Issue #96: npm install CLI support
 * Issue #136: DRY refactoring - isGlobalInstall and getConfigDir extracted to install-context.ts
 * Migrated from scripts/setup-env.sh
 */
import { EnvConfig, EnvSetupOptions, ValidationResult } from '../types';
export { isGlobalInstall, getConfigDir } from './install-context';
/**
 * Default environment configuration values
 * SF-4: DRY - Centralized defaults
 *
 * These are the static values `commandmate init` writes into a new .env file.
 * They are not the runtime resolution order: getEnv() reads every CM_* value
 * from the process environment regardless of what appears here.
 *
 * Issue #135: CM_DB_PATH has no static default - it depends on the install type,
 * so it is resolved dynamically by getDefaultDbPath() instead.
 */
export declare const ENV_DEFAULTS: {
    readonly CM_PORT: 3000;
    readonly CM_BIND: "127.0.0.1";
    readonly CM_LOG_LEVEL: "info";
    readonly CM_LOG_FORMAT: "text";
};
/**
 * Default managed repository directory (CM_ROOT_DIR).
 *
 * CM_ROOT_DIR is the scope CommandMate may manage: repositories must be inside
 * it to be registered, and clones are placed under it. It is a container of
 * repositories, not a repository itself, and is never scanned directly
 * (Issue #1328).
 */
export declare const DEFAULT_ROOT_DIR: string;
/**
 * Get the default database path based on install type
 * Issue #135: Dynamic DB path resolution
 * Issue #136: Uses isGlobalInstall from install-context.ts
 *
 * For global installs: ~/.commandmate/data/cm.db
 * For local installs: <cwd>/data/cm.db (as absolute path)
 *
 * @returns Absolute path to the default database file
 */
export declare function getDefaultDbPath(): string;
/**
 * Get the path to .env file based on install type
 * Issue #119: Global install uses ~/.commandmate/, local uses cwd
 * Issue #136: Uses isGlobalInstall from install-context.ts
 * Issue #136: Added issueNo parameter for worktree-specific .env files
 *
 * @param issueNo - Optional issue number for worktree-specific .env
 * @returns Path to .env file
 */
export declare function getEnvPath(issueNo?: number): string;
/**
 * Resolve path securely by resolving symlinks and verifying within allowed directory
 * Issue #125: Path traversal protection (OWASP A01:2021 - Broken Access Control)
 *
 * @param targetPath - The path to resolve and verify
 * @param allowedBaseDir - The base directory that targetPath must be within
 * @returns The resolved real path
 * @throws Error if path resolves outside allowed directory
 */
export declare function resolveSecurePath(targetPath: string, allowedBaseDir: string): string;
/**
 * Get the PIDs directory path
 * Issue #136: Centralized pids directory path resolution
 *
 * @returns Path to pids directory
 */
export declare function getPidsDir(): string;
/**
 * Get the PID file path based on install type
 * Issue #125: DRY principle - centralized PID file path resolution
 * Issue #136: Uses getConfigDir from install-context.ts
 *
 * @param issueNo - Optional issue number for worktree-specific PID file
 * @returns Path to PID file (uses getConfigDir for consistency)
 */
export declare function getPidFilePath(issueNo?: number): string;
/**
 * Sanitize input by removing control characters
 * SF-SEC-3: Input sanitization
 */
export declare function sanitizeInput(input: string): string;
/**
 * Sanitize path input
 * SF-SEC-3: Path sanitization
 */
export declare function sanitizePath(input: string): string;
/**
 * Normalize a comma-separated CM_BROWSE_ROOTS value (Issue #1517).
 *
 * @param input - Raw comma-separated directories, or undefined.
 * @param resolveEntry - Per-entry resolver; pass `resolvePath` to expand `~`.
 * @returns Normalized comma-separated value, or undefined when empty.
 */
export declare function normalizeBrowseRoots(input: string | undefined, resolveEntry?: (entry: string) => string): string | undefined;
/**
 * Validate port number
 * SF-SEC-3: Port validation
 */
export declare function validatePort(input: string): number;
/**
 * Escape value for .env file
 * SF-SEC-3: Safe .env value escaping
 */
export declare function escapeEnvValue(value: string): string;
/**
 * The VAPID variables already present in an `.env`, if any (Issue #2123).
 *
 * `init --force` rewrites the file from scratch. Regenerating the key pair there
 * would be a data-loss bug wearing a helpful face: the public key is baked into
 * every `PushSubscription` a browser has already created, so a new pair silently
 * orphans every device that had subscribed — they stay in `push_subscriptions`,
 * every send fails, and the reader is told nothing (which is the exact failure
 * mode Issue #2124 was filed about). So an existing pair is carried across.
 *
 * Deliberately a minimal parser rather than `dotenv`: this reads a file that is
 * about to be OVERWRITTEN, so it must not populate `process.env` as a side effect
 * — `dotenv.config()` does, and would leak the old keys into the running CLI.
 * It handles the shapes `escapeEnvValue()` writes (bare, or double-quoted with
 * backslash escapes) and ignores everything else, because anything it cannot
 * parse is safest treated as "not configured": the caller then generates a fresh
 * pair, which is the same outcome as before this Issue.
 *
 * Never throws — an unreadable file means "no keys", not a failed `init`.
 *
 * @param envPath - The `.env` to read.
 * @returns Only the keys that were found; missing ones are absent.
 */
export declare function readExistingVapidKeys(envPath: string): Partial<Pick<EnvConfig, 'CM_VAPID_PUBLIC_KEY' | 'CM_VAPID_PRIVATE_KEY' | 'CM_VAPID_SUBJECT'>>;
/**
 * Environment setup utility
 */
export declare class EnvSetup {
    private envPath;
    constructor(envPath?: string);
    /**
     * Create .env file
     * SF-SEC-1: Sets file permissions to 0600
     */
    createEnvFile(config: EnvConfig, options?: EnvSetupOptions): Promise<void>;
    /**
     * Backup existing .env file
     */
    backupExisting(): Promise<string | null>;
    /**
     * Validate configuration
     */
    validateConfig(config: EnvConfig): ValidationResult;
}
//# sourceMappingURL=env-setup.d.ts.map