/**
 * Stable install location for the signed macOS Keychain helper.
 *
 * Why a stable path: every npm publish re-signs `Agents CLI.app` with a fresh
 * timestamp, producing a new code signature. macOS Keychain trusted-app ACLs
 * are pinned to the exact signature, so the ACL invalidates on every release
 * when the helper lives inside the npm package directory. Copying the .app
 * once to `~/Library/Application Support/agents-cli/` gives it a path that
 * survives `npm i -g`, `scripts/install.sh`, version bumps, etc.
 *
 * This module is the SINGLE SOURCE OF TRUTH for the helper path. Other
 * modules in `src/lib/secrets/` must import `getKeychainHelperPath()` rather
 * than recomputing it.
 */
/** Redirect the install root (test only). Returns the previous override so callers can restore. */
export declare function setInstallRootForTest(dir: string | null): string | null;
/**
 * Idempotent install. Copies the bundled `.app` to the stable user path. Skips
 * if the destination already exists, `codesign --verify` passes, AND the
 * installed executable matches the bundled one byte-for-byte — a valid
 * signature alone is not enough, because an outdated helper signs clean too.
 * `forceReinstall=true` skips all checks and always copies.
 *
 * Notarization is checked via `spctl --assess` after install — a failure is
 * logged as a warning but does NOT throw. Notarization checks require network
 * access (Gatekeeper ticket lookup) and are not load-bearing for the helper's
 * keychain ACL semantics.
 */
export declare function ensureKeychainHelperInstalled(opts?: {
    forceReinstall?: boolean;
}): void;
/**
 * ASYNC, download-capable install — the EXPLICIT onboarding/upgrade path
 * (`agents setup secrets`, the bootstrap upgrade self-heal). When a bundled or
 * locally-built `.app` ships (the common case, and always true this release
 * stage), it installs that copy with NO network. When the tarball lacks the
 * bundle (a fresh `npm i -g` whose tarball dropped it), it fetches the signed +
 * notarized release asset for the running CLI version — sha256 + codesign +
 * Team + notarization verified before install — and installs from the cached
 * copy. The sync `getKeychainHelperPath()` never routes here: it stays sync +
 * network-free and fails loud toward this command when no source exists.
 */
export declare function ensureKeychainHelperInstalledAsync(opts?: {
    forceReinstall?: boolean;
}): Promise<void>;
/**
 * Return the absolute path to the helper executable. If the installed bundle
 * is missing, or is stale relative to the bundled source helper, performs a
 * lazy (re)install first. The staleness check is what lets an upgraded CLI
 * replace a helper a previous version installed — the install never runs on
 * `npm i -g`, so this call site is the only one every machine is guaranteed to
 * pass through.
 *
 * SYNC and network-free by design: this is the secrets hot path, called by
 * every keychain op. It never downloads. When no bundled/local source exists
 * (a tarball that dropped the bundle), the reinstall's `sourceAppPath()` throws
 * loud, directing the user to `agents setup secrets` — the explicit, async,
 * download-capable path (`ensureKeychainHelperInstalledAsync`). Throws on
 * non-darwin.
 */
export declare function getKeychainHelperPath(): string;
/** Diagnostic snapshot of the installed Keychain helper. */
export interface KeychainHelperStatus {
    source: string | null;
    destination: string;
    installed: boolean;
    codesignOk: boolean;
    codesignOutput: string;
    spctlOk: boolean;
    spctlOutput: string;
}
export declare function getKeychainHelperStatus(): KeychainHelperStatus;
