/** The current variable for transport/sync passphrases. */
export declare const SYNC_PASSPHRASE_ENV = "AGENTS_SYNC_PASSPHRASE";
/** The file-store master key, honoured for sync only as a deprecated fallback. */
export declare const LEGACY_PASSPHRASE_ENV = "AGENTS_SECRETS_PASSPHRASE";
/** Reset the one-shot warning latches. Tests only — production never re-warns. */
export declare function resetSyncPassphraseWarnings(): void;
/** Where a resolved sync passphrase came from, so callers can report honestly. */
export type SyncPassphraseSource = 'sync-env' | 'legacy-env' | null;
export interface ResolvedSyncPassphrase {
    value: string | null;
    source: SyncPassphraseSource;
}
/**
 * Read the transport passphrase from the environment, preferring the current
 * variable and falling back to the deprecated one with a single warning.
 * Returns `{ value: null }` when neither is set — the caller decides whether to
 * prompt (TTY) or fail (headless). Never prompts, never throws.
 */
export declare function resolveSyncPassphraseFromEnv(): ResolvedSyncPassphrase;
/**
 * The one-shot reminder that an env-sourced passphrase is readable by other
 * same-user processes. Separate from the deprecation notice above so a caller
 * using the CURRENT variable still gets the readability warning exactly once.
 */
export declare function warnEnvPassphraseReadableOnce(): void;
/** The message a headless caller shows when no passphrase is available. */
export declare function missingSyncPassphraseMessage(): string;
