/**
 * SecretKeyFile
 *
 * Loads (or atomically creates) the 32-byte symmetric key used by
 * LocalSecretBox to encrypt cloud provider tokens at rest.
 *
 * File layout: <shepHomeDir>/secret.key — raw 32 bytes, mode 0o600.
 *
 * On POSIX the `mode` option on writeFileSync enforces owner-only perms.
 * On Windows file mode is mostly advisory; we rely on the parent
 * ~/.shep/ directory being user-only (already set to 0o700 by the
 * shep-directory service), which is the same boundary the existing
 * SQLite database and settings file rely on.
 */
export declare const SECRET_KEY_FILENAME = "secret.key";
export declare function secretKeyFilePath(shepHomeDir: string): string;
/**
 * Return the 32-byte secret key, generating it atomically on first use.
 *
 * Safe to call multiple times — subsequent calls read the cached file.
 */
export declare function loadOrCreateSecretKey(shepHomeDir: string): Buffer;
//# sourceMappingURL=secret-key-file.d.ts.map