/**
 * Declaratively manage operator SSH keys in the box's `authorized_keys`.
 *
 * Keys are written inside a ts-cloud-managed block (delimited by marker
 * comments) so the set can be reconciled on every provision/deploy without
 * disturbing keys added out-of-band: the whole block is rewritten from the
 * config each time. Adding an SSH key is therefore "add an entry + redeploy".
 */
import type { SshKeyConfig } from '@ts-cloud/core';
/** Default authorized_keys path (root deploy user). */
export declare const DEFAULT_AUTHORIZED_KEYS = "/root/.ssh/authorized_keys";
export interface AuthorizedKeysOptions {
    /** authorized_keys file to manage. @default '/root/.ssh/authorized_keys' */
    path?: string;
}
/**
 * Build the commands that reconcile the managed key block in authorized_keys.
 * Strips any previous ts-cloud block, then appends the current set. An empty
 * key set still strips the block — removing your last key from the config must
 * remove it from the box (e.g. revoking a compromised key).
 */
export declare function buildAuthorizedKeysScript(keys?: SshKeyConfig[], options?: AuthorizedKeysOptions): string[];
