/**
 * `agents secrets migrate-acl` — refresh existing keychain items so they pick
 * up the new SecAccess ACL written by the signed Agents CLI.app helper.
 *
 * Items created before 1.19.2 (or by `security add-generic-password` directly)
 * may carry the legacy "this-app-only" ACL that prompts the user for a
 * password on every read. Re-writing them through the helper bakes in the
 * empty trusted-app ACL that suppresses the prompt and lets the helper read
 * them under LocalAuthentication instead.
 *
 * Sequence per item:
 *   1. Read the current value (no auth prompt path — uses the unauthenticated
 *      `security` CLI for non-sync items, helper `get` for sync items).
 *   2. Append (item, value, sync) to an encrypted backup before any writes.
 *   3. Delete + rewrite via the helper so macOS hands us a fresh ACL on the
 *      new item.
 *   4. Read back via the helper to verify the value round-trips.
 *
 * `--dry-run` (default) reports the planned actions. `--commit` performs the
 * writes and produces the backup.
 */
import type { Command } from 'commander';
/** Register the keychain-migration commands (`migrate-acl`, `rekey`) on the
 * parent secrets Command. */
export declare function registerSecretsMigrateAclCommand(secrets: Command): void;
