/**
 * Resolve master passphrase from (in precedence order):
 *   1. opts.flag  (--passphrase)
 *   2. process.env.OWS_PASSPHRASE
 *   3. stdin (only if process.stdin.isTTY === false)
 *
 * Returns null if no path provides one AND stdin IS TTY (caller may prompt).
 * Throws PASSPHRASE_REQUIRED with remediation if no path provides one AND
 * stdin is non-TTY (AC-16).
 */
export declare function resolvePassphrase(opts: {
    flag?: string;
}): Promise<string | null>;