/**
 * Proton Pass — CLI subprocess wrapper.
 *
 * Wraps the official `pass-cli` tool (protonpass/pass-cli). We deliberately
 * never accept or store a Proton account password for Pass; every call uses
 * a scoped **Personal Access Token** the user obtains from the Proton Pass
 * web app (Settings → Developer → Personal Access Tokens).
 *
 * ## Why a CLI subprocess, not a direct HTTP client
 *
 * Proton Pass's crypto envelope is non-trivial (SRP + per-item keys + bulk
 * export handling). The official CLI handles all of it; shelling out avoids
 * re-implementing the crypto in TypeScript and keeps the attack surface
 * small. The trade-off is an external dependency: if `pass-cli` is not
 * installed or not on PATH, all tools return a structured error directing
 * the user to install it.
 *
 * ## Security posture
 *
 * - PAT is read from the config file (mode 0600) OR keychain. Never from
 *   env vars the agent can inspect.
 * - Every call is logged to a hash-chained audit file
 *   (~/.mailpouch-pass-audit.jsonl, mode 0600) with timestamp + tool
 *   name + item ID (but never the secret value itself). Each row carries
 *   `prevHash` + `hash` so a reviewer can detect deletion/edits. The chain
 *   is best-effort and tamper-EVIDENT, not tamper-proof (CRED-009).
 * - No tool returns or logs the decrypted secret in plain text unless the
 *   user has explicitly confirmed via the elicitation gate. That's the
 *   caller's responsibility — this service exposes the raw CLI output.
 */
export interface PassItemSummary {
    id: string;
    /** e.g. "login", "note", "alias", "cc", "identity" */
    type: string;
    name: string;
    vault?: string;
    updatedAt?: string;
}
export interface PassItemDetail extends PassItemSummary {
    /** Present for login items. */
    username?: string;
    /** Password, TOTP, note body, etc. — shape depends on item type. */
    fields?: Record<string, string>;
    note?: string;
    url?: string;
}
/** Thrown when `pass-cli` is not installed or the invocation times out. */
export declare class PassCliUnavailableError extends Error {
    constructor(message: string);
}
export declare class PassService {
    private readonly cliPath;
    private readonly pat;
    private readonly auditPath;
    /**
     * CRED-009: rolling hash of the previous audit row, lazily seeded from the
     * last line on disk. `undefined` means "not yet loaded"; the empty string is
     * the genesis value for an empty/absent log.
     */
    private prevHash;
    constructor(args: {
        personalAccessToken: string;
        cliPath?: string;
        auditLogPath: string;
    });
    isConfigured(): boolean;
    /**
     * Spawn the pass-cli with the given args. Stdin is closed immediately.
     * Returns the decoded stdout on success. Times out after DEFAULT_TIMEOUT_MS.
     */
    private run;
    /**
     * Lazily recover the `hash` of the last row on disk so a chain survives
     * process restarts. Best-effort: a missing/empty/corrupt file restarts the
     * chain from genesis ("").
     */
    private loadPrevHash;
    /**
     * Append one line to the audit log. Never includes secret values.
     *
     * CRED-009: each row is hash-chained — `hash = sha256(prevHash + JSON.stringify(base))`,
     * where `base` is the row WITHOUT the `hash` field but WITH `prevHash` already
     * embedded in it (so prevHash is bound into the row both directly and via the
     * hash input). A reviewer can recompute the chain to detect deletion or
     * in-place edits. This is
     * tamper-EVIDENT, not tamper-PROOF: an attacker with write access can rewrite
     * the whole file and recompute every hash. The log is best-effort (no fsync,
     * no rotation lock); treat a broken chain as "investigate", not "trusted".
     */
    private audit;
    listItems(vault?: string): Promise<PassItemSummary[]>;
    searchItems(query: string): Promise<PassItemSummary[]>;
    getItem(itemId: string): Promise<PassItemDetail>;
    private parseJsonArray;
    private parseJsonObject;
}
//# sourceMappingURL=pass-service.d.ts.map