export declare function machineKeyFilePath(): string;
/**
 * Read the shield key mirrored for S4U/task contexts. Plain in-process file
 * read — safe for the shell-free resolution path. Undefined when absent,
 * unreadable, malformed, or recorded for a different shield.
 */
export declare function readShieldKeyFromMachineFile(shieldId: string): string | undefined;
/**
 * Mirror the shield key for S4U/task contexts, read-back verified. Called
 * from contexts that already hold the decrypted key (enrollment, and the
 * resolution self-heal in config.ts). Returns false on any failure — the
 * caller's primary stores are untouched either way.
 */
export declare function saveShieldKeyToMachineFile(shieldId: string, shieldKey: string): boolean;
/** Remove the mirror (unenroll / re-enroll cleanup). Best-effort. */
export declare function deleteMachineKeyFile(): void;
/**
 * Deep self-test probe: write + read-back + ACL inspection with the exact
 * code paths used for the shield key. Proves the S4U fallback store works
 * end-to-end on THIS machine.
 */
export declare function machineKeyFileProbe(): {
    ok: boolean;
    detail: string;
};