/**
 * @license
 * Copyright 2025 Steven Roussey <sroussey@gmail.com>
 * SPDX-License-Identifier: Apache-2.0
 */
import { LazyEncryptedCredentialStore } from "@workglow/storage";
import { OtpPassphraseCache } from "@workglow/util";
/**
 * Lazy credential store backed by encrypted file-based KV storage.
 * Starts locked; call {@link ensureCredentialStoreUnlocked} before
 * accessing encrypted credentials.
 */
export declare const lazyStore: LazyEncryptedCredentialStore;
/**
 * In-memory OTP-masked passphrase cache with 6-hour hard TTL.
 * When the cache expires the lazy store is automatically locked.
 */
export declare const passphraseCache: OtpPassphraseCache;
/**
 * Resolves the credential passphrase from (in priority order):
 * 1. `WORKGLOW_CREDENTIAL_PASSPHRASE` environment variable
 * 2. OS keyring via `@napi-rs/keyring`
 * 3. Legacy `~/.workglow/.credential-key` file (migrates to keyring, then deletes file)
 * 4. Generates a new random passphrase and stores it in the keyring
 */
export declare function resolvePassphraseFromKeyring(): Promise<string>;
/**
 * Ensures the lazy credential store is unlocked and ready for use.
 * Retrieves the passphrase from the OTP cache if still valid, otherwise
 * resolves it from the keyring (or generates a new one).
 */
export declare function ensureCredentialStoreUnlocked(): Promise<void>;