/**
 * `agents secrets rotate-passphrase` — rotate the encrypted file store's
 * machine-local master passphrase (RUSH-1975).
 *
 * Re-encrypts every `<item>.enc` under a freshly generated key and rewrites the
 * 0600 key file in place, atomically: the new store is staged, verified
 * (round-trip + count), fsync'd, then swapped by directory rename, so a crash
 * leaves the old store intact and readable. Headless-safe and Linux-first — the
 * remediation path for a compromised passphrase (RUSH-1968), where the two
 * supported alternatives are unacceptable (a hand-rolled non-atomic script, or
 * export-to-plaintext which is the exposure being fixed).
 *
 * Dry-run by default, matching `import-keyring`; `--commit` performs the swap.
 */
import type { Command } from 'commander';
/** Register `agents secrets rotate-passphrase` on the parent secrets Command. */
export declare function registerSecretsRotatePassphraseCommand(secrets: Command): void;
