/**
 * npmrc — safely manage the GitHub Packages credential for @openlife-business
 * inside the user's ~/.npmrc.
 *
 * `openlife upgrade` writes two lines so `npm i -g @openlife-business/cli` can
 * authenticate against the private registry:
 *
 *   @openlife-business:registry=https://npm.pkg.github.com
 *   //npm.pkg.github.com/:_authToken=<token>
 *
 * SECURITY / open-core boundary:
 *   - We ALWAYS write to ~/.npmrc (os.homedir()), NEVER process.cwd(), so the
 *     token can never land inside the repository.
 *   - The file is written with mode 0o600 (owner read/write only) — a registry
 *     token is a secret.
 *   - Edits are idempotent and surgical: re-running upsert replaces the two
 *     lines in place (token rotation) instead of duplicating them, and remove
 *     deletes only those two lines, preserving every other entry the user has.
 */
export interface BusinessRegistryOpts {
    /** npm scope, e.g. "@openlife-business". */
    scope: string;
    /** Registry URL, e.g. "https://npm.pkg.github.com". */
    registry: string;
    /** Auth token with read:packages scope. */
    token: string;
}
export interface NpmrcResult {
    changed: boolean;
    path: string;
}
/**
 * Ensure the scope registry + auth token lines exist (replacing any prior
 * pair). Returns whether the file content actually changed.
 */
export declare function upsertBusinessRegistry(opts: BusinessRegistryOpts, npmrcPath?: string): NpmrcResult;
/**
 * Remove the @openlife-business registry + its matching auth token line. The
 * host is derived from the existing registry line, so this works for any
 * registry/proxy the upgrade flow may have configured. Other entries are left
 * untouched; the file is never deleted.
 */
export declare function removeBusinessRegistry(scope?: string, npmrcPath?: string): NpmrcResult;
