/**
 * Schedule a one-time, best-effort re-sync of every vault secret (across
 * every tenant) into the shared credential store, a few seconds after boot.
 *
 * Why this exists: `syncSecretsToCredentialStore` only runs when a vault
 * secret is created or updated, so it only re-encrypts rows a user happens
 * to touch. When the shared `app_secrets` encryption format changes under
 * it — e.g. the `shared_encrypted_value` dual-write, or hosted workspaces
 * deriving shared key material from `A2A_SECRET` — existing rows are stuck
 * on the old format until someone manually re-saves each vault secret,
 * which breaks sibling apps reading them. Re-running the sync for every row
 * at boot self-heals that without any manual step.
 *
 * Fires at most once per process (`scheduled` guard) so calling this again
 * — e.g. if the owning plugin module re-runs under dev's `*-plugin.ts` HMR
 * reload — doesn't stack duplicate timers. Runs fully non-blocking: it
 * never delays startup, and any failure is caught and logged rather than
 * thrown, since a stale-encryption row is a degraded state, not a crash.
 */
export declare function scheduleVaultBootResync(): void;
/** Test-only: reset the once-per-process guard between spec runs. */
export declare function __resetVaultBootResyncGuardForTests(): void;
//# sourceMappingURL=vault-boot-resync.d.ts.map