import type { SshCommand } from "./sshCommand.js";
/**
 * Returns the SSH StrictHostKeyChecking policy.
 * Set KASTELL_STRICT_HOST_KEY=true to reject unknown host keys (more secure, requires manual key management).
 * Default: "accept-new" (TOFU — trust on first use, verify on subsequent connections).
 */
export declare function getHostKeyPolicy(): string;
export declare function resolveSshPath(): string;
export declare function resolveScpPath(): string;
/**
 * Remove stale host key for an IP from known_hosts.
 * Best-effort — failures are silently ignored.
 */
export declare function clearKnownHostKey(ip: string): void;
export declare function checkSshAvailable(): boolean;
export declare function assertValidIp(ip: string): void;
export declare function sanitizedEnv(): NodeJS.ProcessEnv;
/**
 * Removes stale host key entry for the given IP from known_hosts.
 * Silently ignores errors (ssh-keygen not available or no entry).
 * IP is validated before use to prevent command injection.
 */
export declare function removeStaleHostKey(ip: string): void;
export declare const HOST_KEY_PATTERN: RegExp;
export declare function isHostKeyMismatch(stderr: string): boolean;
export declare function sshConnect(ip: string): Promise<number>;
export declare function sshStream(ip: string, command: SshCommand, opts?: {
    useStdin?: boolean;
}): Promise<number>;
export declare function sshExec(ip: string, command: SshCommand, opts?: {
    timeoutMs?: number;
    useStdin?: boolean;
}): Promise<{
    code: number;
    stdout: string;
    stderr: string;
}>;
/**
 * Open a persistent SSH master connection for the given IP.
 * Subsequent sshExec calls to the same IP will reuse this connection
 * instead of opening new TCP+SSH handshakes (prevents MaxStartups exhaustion).
 */
export declare function sshMasterOpen(ip: string): Promise<boolean>;
/**
 * Close the SSH master connection for the given IP.
 */
export declare function sshMasterClose(ip: string): void;
/** Returns ControlPath args if a master is active for this IP */
export declare function getControlArgs(ip: string): string[];
//# sourceMappingURL=ssh.d.ts.map