/**
 * SSH auth helper for universal-git sources.
 *
 * When a universal-git source uses `credentialType: 'ssh'`, the agent needs
 * three things to run `git clone`:
 *   1. The PEM-encoded private key materialized to a tempfile with mode 0600.
 *   2. A `GIT_SSH_COMMAND` that points `ssh -i` at that tempfile.
 *   3. A `StrictHostKeyChecking` policy that matches the source config —
 *      either `accept-new` (TOFU) or `yes` with a pinned `known_hosts` file.
 *
 * This module provides the orchestrator-side primitives for preparing those
 * artefacts. It is used in two contexts:
 *   - **Agent-side** (Phase 4+): the agent receives the PEM + host-key policy
 *     in the dispatch message and materializes them before cloning.
 *   - **Lock-file fetcher** (Phase 2, this module's immediate consumer):
 *     the orchestrator shallow-clones the source repo itself at registration
 *     time, using the same SSH materialization path.
 *
 * All materialized tempfiles are created under `os.tmpdir()` in a private
 * per-call subdirectory (`fs.mkdtempSync(.../kici-ugit-ssh-`)`), so
 * concurrent clones never clobber each other. The returned `cleanup()`
 * closure removes the directory recursively — callers MUST call it in a
 * `finally` block.
 */
import type { SshHostKeyPolicy } from './config.js';
/** Material the caller has prepared (key file + optional known_hosts file). */
export interface SshAuthArtefacts {
    /** Absolute path to the private key file (mode 0600). */
    privateKeyPath: string;
    /** Absolute path to the known_hosts file, if `policy === 'pinned'`. */
    knownHostsPath?: string;
    /** Complete GIT_SSH_COMMAND string to export when running git. */
    gitSshCommand: string;
    /** Dispose of every tempfile + the parent directory. Must be called. */
    cleanup: () => Promise<void>;
}
/**
 * Synchronous variant — used when the caller is already in synchronous
 * lock-file fetching logic. The structure matches the async version so
 * callers can swap freely.
 */
export interface SshAuthArtefactsSync {
    privateKeyPath: string;
    knownHostsPath?: string;
    gitSshCommand: string;
    cleanup: () => void;
}
/** Options common to both sync and async variants. */
export interface PrepareSshAuthOptions {
    /** PEM-encoded private key. */
    privateKey: string;
    /** Host-key verification policy. */
    policy: SshHostKeyPolicy;
    /**
     * OpenSSH known_hosts content. Required when `policy === 'pinned'`, ignored
     * otherwise.
     */
    knownHostsPem?: string;
}
/**
 * Async: materialize the private key (and pinned known_hosts) into a private
 * tempdir, returning paths + the `GIT_SSH_COMMAND` the agent should export.
 *
 * @throws If `policy === 'pinned'` and `knownHostsPem` is missing.
 */
export declare function prepareSshAuth(opts: PrepareSshAuthOptions): Promise<SshAuthArtefacts>;
/**
 * Sync variant of `prepareSshAuth`. Semantics are identical; the caller
 * receives a synchronous `cleanup()` closure.
 */
export declare function prepareSshAuthSync(opts: PrepareSshAuthOptions): SshAuthArtefactsSync;
/**
 * Compose the GIT_SSH_COMMAND string. Honors the host-key policy:
 *   - `accept-new`: `StrictHostKeyChecking=accept-new` (TOFU on the per-call
 *     empty known_hosts file).
 *   - `pinned`: `StrictHostKeyChecking=yes` (rejects any unknown host key).
 *
 * Both policies pin `UserKnownHostsFile` to the per-call tempfile so the
 * orchestrator never reads or writes the runtime user's
 * `~/.ssh/known_hosts`. Without this, a stale entry there for a host:port
 * we're cloning from blocks the connection (accept-new still rejects
 * mismatches against cached keys). The per-call file is wiped by `cleanup()`.
 *
 * IdentitiesOnly=yes ensures ssh ignores any agent-forwarded keys and only
 * uses the one we provided; this is critical in staging where the runner
 * user may have a populated ssh-agent.
 */
export declare function composeGitSshCommand(privateKeyPath: string, policy: SshHostKeyPolicy, knownHostsPath: string): string;
/**
 * Shell-quote a path for embedding in `GIT_SSH_COMMAND`. Single-quotes the
 * string and escapes embedded single quotes — matches POSIX shell parsing.
 */
export declare function quoteShell(path: string): string;
//# sourceMappingURL=ssh-auth.d.ts.map