import { type ExecFn } from "./windows-acl.js";
export type PermissionCheck = {
    ok: boolean;
    isSymlink: boolean;
    isDir: boolean;
    mode: number | null;
    bits: number | null;
    source: "posix" | "windows-acl" | "unknown";
    worldWritable: boolean;
    groupWritable: boolean;
    worldReadable: boolean;
    groupReadable: boolean;
    aclSummary?: string;
    error?: string;
};
export type PermissionCheckOptions = {
    platform?: NodeJS.Platform;
    env?: NodeJS.ProcessEnv;
    exec?: ExecFn;
};
export declare function safeStat(targetPath: string): Promise<{
    ok: boolean;
    isSymlink: boolean;
    isDir: boolean;
    mode: number | null;
    uid: number | null;
    gid: number | null;
    error?: string;
}>;
export declare function inspectPathPermissions(targetPath: string, opts?: PermissionCheckOptions): Promise<PermissionCheck>;
export declare function formatPermissionDetail(targetPath: string, perms: PermissionCheck): string;
export declare function formatPermissionRemediation(params: {
    targetPath: string;
    perms: PermissionCheck;
    isDir: boolean;
    posixMode: number;
    env?: NodeJS.ProcessEnv;
}): string;
export declare function modeBits(mode: number | null): number | null;
export declare function formatOctal(bits: number | null): string;
export declare function isWorldWritable(bits: number | null): boolean;
export declare function isGroupWritable(bits: number | null): boolean;
export declare function isWorldReadable(bits: number | null): boolean;
export declare function isGroupReadable(bits: number | null): boolean;
/**
 * Recursively enforce secure permissions on all auth profile files and directories.
 *
 * Directories: 0o700 (owner-only access)
 * Files: 0o600 (owner-only read/write)
 *
 * Context: `fs.mkdir(..., { recursive: true, mode: 0o700 })` only applies mode
 * to the leaf directory created, not to any parent directories that already exist
 * or are created during recursion. This function walks the entire tree and
 * re-hardens all paths.
 *
 * @param rootDir - Root directory to recursively harden (e.g., ~/.minion)
 * @returns Object with counts of directories and files hardened
 */
export declare function hardenAuthPaths(rootDir: string): Promise<{
    dirsHardened: number;
    filesHardened: number;
    errors: Array<{
        path: string;
        error: string;
    }>;
}>;
