import fs from "node:fs";
/** This process's user SID. The SID is the only locale-independent identity Node
 *  can obtain without a native binding; %USERNAME% gives a name that still has to
 *  be resolved, and resolution is exactly what localisation breaks. */
export declare function currentWindowsSid(): string | undefined;
/** Trustees granted access by an SDDL security descriptor, upper-cased.
 *
 *  SDDL DACL shape: `D:AI(A;OICIID;FA;;;SY)(A;;FA;;;S-1-5-21-…)`. The trustee is
 *  the sixth semicolon-separated field of each ACE — either a two-letter
 *  well-known alias or a raw SID, neither of which is localised.
 *
 *  `icacls /save` emits the DACL only (no `O:`/`G:` prefix), which is what this
 *  reads; an owner/group prefix is not handled because it never appears here, and
 *  `G:BAD:AI(…)` is genuinely ambiguous to parse.
 *
 *  Exported for tests: this parser decides whether a path counts as shared. */
export declare function parseSddlTrustees(sddl: string): string[];
/** Whether a DACL's trustees mean "only this user can reach it".
 *
 *  Exported for tests: with {@link parseSddlTrustees} this is the whole verdict,
 *  and it must be checkable without a Windows box to read an ACL from.
 *
 *  Empty is not a pass — no parsed trustee means the descriptor was not
 *  understood, and guessing there would report an unreadable ACL as safe. */
export declare function trusteesAreOwnerOnly(trustees: readonly string[], mySid: string): boolean;
/** True when only the current user (plus the unavoidable privileged trustees)
 *  can reach `target`. Windows only; undefined when it cannot tell.
 *
 *  Reads the descriptor as SDDL rather than parsing `icacls`'s human output,
 *  because that output is localised and this comparison must not be. */
export declare function windowsPathIsOwnerOnly(target: string): boolean | undefined;
/**
 * True when `target` is readable only by its owner.
 *
 * POSIX callers pass the already-taken Stats to avoid a second syscall.
 */
export declare function pathIsOwnerOnly(target: string, stats?: fs.Stats): boolean;
/**
 * Restrict `directory` to the current user, and make new children inherit that.
 *
 * One call at setup/boot covers every file the instance will ever write, which
 * is why this is a directory operation rather than a per-file chmod: on Windows
 * inheritance is the only way to get the property without touching each file.
 *
 * Returns true only when the directory is owner-only AFTERWARDS — the result is
 * verified, never assumed, because the caller prints it as an assurance. Never
 * throws: a hardening failure must not stop the gateway from starting, and the
 * caller logs it.
 */
export declare function enforceOwnerOnlyDirectory(directory: string): boolean;
//# sourceMappingURL=owner-only.d.ts.map