/**
 * Cross-platform OS keychain backend for the secrets resolver.
 *
 * Per-platform dispatch via `process.platform`:
 *   - darwin → `security find-generic-password -s <svc> -a <acc> -w` (stdout = pw)
 *   - linux  → `secret-tool lookup service <svc> account <acc>`     (stdout = pw)
 *   - win32  → `cmdkey /list:<svc>:<acc>` (Phase 1 illustrative existence-check;
 *              real value retrieval requires the Windows Credential Manager API
 *              and is deferred to a later phase — see UI.7 hand-off note in
 *              task 1.17 risk-callouts).
 *   - other  → null (unsupported platform).
 *
 * The dispatch is STRICT: macOS code paths never run on Linux, and vice versa.
 * No env-var-driven cross-platform shimming.
 *
 * Reference shape:
 *   - `<account>`              → uses default service (configured via opts.service)
 *   - `<service>/<account>`    → overrides service for this lookup
 *
 * Subprocess discipline (matches op.ts):
 *   - `stdio: ['ignore', 'pipe', 'pipe']` — no stdin needed.
 *   - SIGTERM after `timeoutMs` (default 5000) to bound interactive consent
 *     prompts (macOS Keychain may pop a system dialog on first access).
 *   - Spawn errors (binary missing) and non-zero exits BOTH return null at the
 *     public API. Internally the helper still distinguishes the two so future
 *     telemetry can surface "backend missing" vs "not found" separately.
 *
 * Security:
 *   - NEVER log resolved secret values. This module logs nothing.
 *
 * macOS gotcha (post-research note, UI.7 hand-off): on first access to a
 * keychain item, macOS may prompt the user to allow access. The 5s timeout
 * catches a blocked prompt, but the setup UI should warn users.
 *
 * Imports from: node:child_process, ../types.js.
 * Imported by: src/secrets/index.ts.
 */
import type { SecretBackend } from '../types.js';
export interface KeychainBackendOptions {
    /** Default service name used when a ref has no `<service>/` prefix. Default 'opensquid'. */
    service?: string;
    /** Subprocess timeout in ms. Default 5000. */
    timeoutMs?: number;
    /**
     * Optional per-platform binary overrides. Used by tests to inject fake CLIs
     * that mimic the real binaries' argv shape without depending on a real
     * Keychain / libsecret / Credential Manager being present.
     *
     * Production code paths leave these undefined, so the real `security`,
     * `secret-tool`, and `cmdkey` are invoked via PATH lookup.
     */
    binaries?: {
        darwin?: string;
        linux?: string;
        win32?: string;
    };
}
export declare function keychainBackend(opts?: KeychainBackendOptions): SecretBackend;
//# sourceMappingURL=keychain.d.ts.map