/**
 * sudo process helpers.
 *
 * Password discipline:
 *  - stdin only, never argv (ps-visible), never env (inherited by children)
 *  - no reliance on sudo's timestamp cache: it is keyed per-tty and pi's
 *    spawned processes have none, so every run is fed the password directly
 */
export interface RunResult {
    stdout: string;
    stderr: string;
    code: number;
}
/**
 * Validate a password against sudo.
 * `-k` drops any cached timestamp so a stale one cannot mask a wrong guess.
 */
export declare function validatePassword(password: string): Promise<boolean>;
/** Run a shell command as root, feeding the password over stdin. */
export declare function runSudo(command: string, timeoutMs: number, password: string): Promise<RunResult>;