/**
 * @file Windows backend via PowerShell CredentialManager module, with a
 *   DPAPI-encrypted file fallback. Two paths, tried in order:
 *
 *   1. CredentialManager PowerShell module (`New-StoredCredential` /
 *      `Get-StoredCredential` / `Remove-StoredCredential`). The cleanest path —
 *      stored credentials live in the Windows Credential Manager, the same
 *      place `cmdkey` writes to. Requires the module to be installed
 *      (`Install-Module CredentialManager -Scope CurrentUser`).
 *   2. DPAPI-encrypted file under `%APPDATA%\<service>\<account>.enc`. Used when
 *      the CredentialManager module isn't available.
 *      `System.Security.Cryptography.ProtectedData` encrypts under the
 *      current-user machine key — readable only by this user on this machine,
 *      never plaintext. The target name composed for CredentialManager is
 *      `service:account` (matching `cmdkey /generic:<target>` convention).
 */
export declare function buildTarget(service: string, account: string): string;
export declare function deleteWindows(service: string, account: string): Promise<'removed' | 'absent'>;
export declare function deleteWindowsSync(service: string, account: string): 'removed' | 'absent';
export declare function getDpapiFilePath(service: string, account: string): string;
export declare function isWindowsBackendAvailable(): boolean;
export declare function quotePs(value: string): string;
export declare function readDpapi(filePath: string): Promise<string | undefined>;
export declare function readDpapiSync(filePath: string): string | undefined;
export declare function readWindows(service: string, account: string): Promise<string | undefined>;
export declare function readWindowsSync(service: string, account: string): string | undefined;
export declare function runPsAsync(script: string, input?: string): Promise<{
    status: number | null;
    stdout: string;
    stderr: string;
}>;
export declare function runPsSync(script: string, input?: string): {
    status: number | null;
    stdout: string;
    stderr: string;
};
/**
 * Reject identifier components (service / account names) that contain path
 * separators, `..` segments, or NUL bytes. These would escape the intended
 * `%APPDATA%\<service>\<account>.enc` layout and let a caller read or overwrite
 * arbitrary files under the user's profile.
 *
 * Throws on bad input rather than sanitizing — callers should pass logical
 * identifiers (e.g. `socket-cli`, `SOCKET_API_KEY`), not paths.
 */
export declare function validateKeychainComponent(value: string, name: string): void;
export declare function writeDpapi(filePath: string, value: string): Promise<void>;
export declare function writeDpapiSync(filePath: string, value: string): void;
export declare function writeWindows(service: string, account: string, value: string, _label: string): Promise<void>;
export declare function writeWindowsSync(service: string, account: string, value: string, _label: string): void;
