/**
 * On-demand download + verification of the macOS keychain broker helper
 * ("Agents CLI.app").
 *
 * Mirrors the ComputerHelper / MenubarHelper download model
 * (`../helper-download.ts`): the helper ships as a signed + notarized `.app`
 * zipped as a GitHub release asset on the helper's own `keychain/v<x.y.z>` tag,
 * NOT the CLI's tag (see `helper-versions.ts`). A fresh `npm i -g`
 * machine whose tarball lacks a bundled copy fetches the asset for the running
 * CLI version, verifies its sha256 + code signature before install.
 *
 * Unlike the menu-bar helper, the keychain helper pins NO designated
 * requirement (no `expectedBundleId`). The menu-bar `expectedBundleId` exists
 * because macOS keys the Accessibility (TCC) grant to the bundle's designated
 * requirement, so a substituted bundle whose DR does not pin (id, team) would
 * silently revoke that upgrade-stable grant. The keychain helper has no such
 * DR-keyed grant to protect: its items are gated by the access-group
 * entitlement (`keychain-helper.swift` → `kSecAttrAccessGroup`, the
 * `keychain-access-groups` entitlement) plus a biometry `SecAccessControl`
 * (user presence) — NOT a `SecTrustedApplication` ACL keyed to a bundle-id/DR.
 * The release-time gate `scripts/verify-keychain-helper.sh` correspondingly
 * pins the executable's sha256, not a designated requirement. So Team +
 * notarization is the verification boundary here, exactly like ComputerHelper.
 */
import { type HelperSpec } from '../helper-download.js';
/** The zipped `.app` release asset name (the bundle name has a space). */
export declare const KEYCHAIN_HELPER_ASSET = "Agents_CLI.app.zip";
/** The bundle directory name once extracted. */
export declare const KEYCHAIN_HELPER_APP_NAME = "Agents CLI.app";
/** Keychain-helper identity + verification policy — Team + notarization only,
 *  no DR pin (see docblock). */
export declare const KEYCHAIN_HELPER_SPEC: HelperSpec;
/** Release-asset URLs for the keychain helper zip + its checksum at `v<version>`. */
export declare function keychainHelperAssetUrls(version: string): {
    zip: string;
    sha256: string;
};
/** Cache dir for the downloaded keychain helper, one subdir per release tag. */
export declare function keychainHelperCacheDir(version: string): string;
/** Verify a keychain helper `.app`: codesign + Team + notarization (no DR pin). */
export declare function verifyKeychainHelper(appPath: string): void;
/**
 * Download the keychain helper release asset for `version`, verify sha256 +
 * signature, and return the path to the extracted `Agents CLI.app` in the
 * cache. A missing asset is a hard error naming the exact tag.
 */
export declare function downloadKeychainHelperApp(version: string): Promise<string>;
