/**
 * macOS Keychain store helpers for `email-mcp account set-secret`.
 *
 * Storing a secret must never put it in argv (visible via `ps`). The `security`
 * CLI supports exactly one hygienic path for that: pass `-w` as the FINAL
 * argument with no value, which makes it prompt on the controlling terminal
 * (and confirm). So the stored secret is typed by the human into security's
 * own prompt — it never passes through this process or its argv.
 *
 * Multi-account: each account is a distinct generic-password item sharing the
 * service "email-mcp", keyed by its account attribute. `-U` updates in place
 * when re-running for an existing account.
 */
export declare const KEYCHAIN_SERVICE = "email-mcp";
/** Args for `security` to store/update account's secret via its own prompt. */
export declare function buildKeychainStoreArgs(service: string, account: string): string[];
/** The config.toml value that points `password` at this account's Keychain item. */
export declare function keychainRefFor(account: string): string;
/**
 * Whether storeSecretNonInteractive has a backend here.
 *
 * Kept beside that function so the two cannot drift: offering to store a
 * secret on a platform with no backend would fail after the user said yes.
 */
export declare function keychainSupported(platform?: NodeJS.Platform): boolean;
/**
 * Run `security` interactively so the user types the secret into its prompt.
 * stdio is inherited: security owns the terminal for the prompt. Resolves on
 * exit 0, rejects otherwise. The secret never touches this process.
 */
export declare function runKeychainStore(account: string, service?: string): Promise<void>;
/**
 * Store a secret non-interactively (used by `migrate-secret`, where the value
 * comes from the existing config rather than a human).
 *
 *   • Linux: `secret-tool store` reads the secret from stdin — argv-clean.
 *   • macOS: the `security` CLI has no stdin path and its interactive prompt
 *     cannot be driven reliably, so the value goes on argv for the brief life
 *     of the child process. This is a one-time migration that REMOVES a
 *     permanent plaintext-at-rest copy, so it is a net improvement; new
 *     secrets should use `set-secret`, whose prompt never touches argv.
 */
export declare function storeSecretNonInteractive(account: string, secret: string, service?: string, osPlatform?: NodeJS.Platform): Promise<void>;
//# sourceMappingURL=keychain-store.d.ts.map