/**
 * Helpers for `account migrate-secret`: move an account's plaintext password
 * out of config.toml and into the OS keychain, leaving a `keychain:<account>`
 * reference behind.
 *
 * These operate on the config TEXT (not the parsed object) so comments and
 * formatting survive — a parse/re-stringify round-trip would drop them. The
 * edit is scoped to the target account's own `password` line, found by walking
 * account blocks, so a shared password value elsewhere is never touched.
 */
/**
 * Return the plaintext password for an account, or null if the account is
 * absent or its password is already an indirection reference.
 */
export declare function extractAccountPassword(configText: string, account: string): string | null;
/**
 * Replace the target account's `password` line with `password = "keychain:<account>"`.
 * Idempotent (an existing keychain ref is left as-is). Throws if the account
 * has no password line at all.
 */
export declare function rewritePasswordToKeychainRef(configText: string, account: string): string;
/**
 * Move one account's plaintext password out of config.toml into the OS
 * keychain, verify the stored value, then rewrite the config to a
 * `keychain:<account>` reference (0600). Idempotent and safe to re-run.
 */
export declare function migrateAccountSecret(account: string, configPath?: string): Promise<void>;
//# sourceMappingURL=secret-migrate.d.ts.map