import { execFileSync as _execFileSync } from 'child_process';
/** @internal Test-only: override execFileSync for mocking */
export declare function _setExecFileSync(fn: typeof _execFileSync): void;
/** Platform-agnostic user-authentication contract. */
export interface UserAuthenticator {
    /** Check if authentication is available on this platform */
    isAvailable(): Promise<boolean>;
    /** Request user authentication. Throws if denied or unavailable. */
    authenticate(reason: string): Promise<void>;
}
export declare class AuthenticationDeniedError extends Error {
    constructor(message?: string);
}
export declare class AuthenticationUnavailableError extends Error {
    constructor(message?: string);
}
/**
 * macOS authenticator with Touch ID → system password fallback.
 *
 * 1. If Touch ID hardware is available, uses node-mac-auth (biometric prompt)
 * 2. If not (Mac mini, old MacBook, lid closed), falls back to osascript
 *    confirmation dialog (no admin privileges required)
 *
 * Security note (Phase 1): Both Touch ID and password dialog serve as UX
 * gates — they prevent accidental secret exposure by requiring physical
 * user presence. The authentication and Keychain read are separate
 * operations. Phase 2 will merge these into a single native call using
 * Security.framework's kSecAccessControlUserPresence for OS-level protection.
 */
export declare class MacOSAuthenticator implements UserAuthenticator {
    isAvailable(): Promise<boolean>;
    authenticate(reason: string): Promise<void>;
    private tryTouchId;
    private promptSystemPassword;
}
/**
 * Fallback authenticator for platforms without supported authentication.
 * Always reports unavailable and throws on authenticate().
 */
export declare class NoopAuthenticator implements UserAuthenticator {
    isAvailable(): Promise<boolean>;
    authenticate(_reason: string): Promise<void>;
}
/**
 * Create a platform-appropriate authenticator.
 * - macOS: Touch ID with system password fallback
 * - Others: NoopAuthenticator (restore not available)
 * @param platform - Override for testing (defaults to process.platform)
 */
export declare function createAuthenticator(platform?: string): UserAuthenticator;
//# sourceMappingURL=user-authenticator.d.ts.map