export interface AgySecurityResult {
    status: number | null;
    detail?: string;
}
export type AgySecurityRunner = (args: readonly string[], env: NodeJS.ProcessEnv) => AgySecurityResult;
export interface AgyKeychainOptions {
    platform?: NodeJS.Platform;
    runSecurity?: AgySecurityRunner;
}
/**
 * Typed, bounded setup result. `unsafe` means the profile path or target
 * identity is not proven and callers must refuse the vendor child; a false
 * value is a recoverable security-tool miss where agy's file fallback may
 * still keep authentication working.
 */
export declare class AgyProfileKeychainError extends Error {
    readonly code: "agy_profile_keychain_unavailable";
    readonly unsafe: boolean;
    constructor(detail: string, options?: {
        unsafe?: boolean;
    });
}
export declare function isAgyProfileKeychainUnsafe(error: unknown): boolean;
/** The only keychain path agy may use for one named profile. */
export declare function agyProfileKeychainPath(profileHome: string): string;
/**
 * Prepare the private Darwin keychain declared by the agy capability profile.
 * Other platforms deliberately do nothing: Linux and Windows retain their
 * vendor-owned credential behavior. The helper never reads, copies, or
 * removes credential items; agy itself remains the only item owner. Creation
 * uses a neutral bootstrap filename before adopting login.keychain-db because
 * Apple's create operation treats the latter name as a user-list entry on the
 * supported Darwin path.
 */
export declare function prepareAgyProfileKeychain(profileHome: string, options?: AgyKeychainOptions): void;
/**
 * Low-level Darwin ensure used by the adapter's production seams and tests.
 * The caller has already established that this is the private agy route.
 */
export declare function ensureAgyProfileKeychain(profileHome: string, options?: AgyKeychainOptions): void;
//# sourceMappingURL=keychain.d.ts.map