/**
 * Filesystem permissions for the epistery config tree.
 *
 * ~/.epistery holds wallet mnemonics and private keys in cleartext. Even once
 * keys move into device hardware there will always be a cleartext fallback, so
 * the floor is: secrets are owner-only.
 *
 *   files: 0600   dirs: 0700
 *
 * Two enforcement points:
 *   - every write goes through {@link secureFile} / {@link secureDir}, which
 *     also repairs a pre-existing file that was created too open;
 *   - {@link auditTree} / {@link secureTree} back `epistery permissions
 *     [--fix]` for everything already on disk.
 *
 * chmod is a no-op on Windows, where ACLs (not mode bits) govern access; the
 * helpers skip it there rather than pretend.
 */
export declare const SECRET_FILE_MODE = 384;
export declare const SECRET_DIR_MODE = 448;
/** Permission bits granted to group or other — anything here is too open. */
export declare const TOO_OPEN_MASK = 63;
/** True when the mode grants any group/other access. */
export declare function isTooOpen(mode: number): boolean;
/** Render a mode as the octal string humans read in `ls -l` output (e.g. "664"). */
export declare function formatMode(mode: number): string;
/**
 * Tighten one path to `mode` if it currently grants group/other access.
 * Returns the previous mode when it changed anything, else null. Never throws:
 * a path we don't own is reported by the audit rather than aborting a save.
 */
export declare function secureTo(path: string, mode: number): Promise<number | null>;
/** Tighten a config file to 0600. */
export declare function secureFile(path: string): Promise<number | null>;
/** Tighten a config directory to 0700. */
export declare function secureDir(path: string): Promise<number | null>;
/** Synchronous variant, for the one bootstrap write that cannot await. */
export declare function secureToSync(path: string, mode: number): number | null;
export interface PermissionEntry {
    path: string;
    type: 'file' | 'dir';
    mode: number;
    expected: number;
}
/**
 * Walk a config tree and report every file/directory that grants group or
 * other access. Symlinks are reported but not followed — a symlink out of the
 * tree is not ours to chmod.
 */
export declare function auditTree(root: string): Promise<PermissionEntry[]>;
/**
 * Tighten everything `auditTree` flags. Returns the entries that were fixed
 * (with their previous mode) and the ones that could not be — a path owned by
 * another user, say — so the caller can report both.
 */
export declare function secureTree(root: string): Promise<{
    fixed: PermissionEntry[];
    failed: PermissionEntry[];
}>;
export declare function warnIfTooOpen(path: string): void;
/** True when a parsed config carries cleartext key material. */
export declare function holdsSecrets(data: any): boolean;
//# sourceMappingURL=Permissions.d.ts.map