import { type SessionResult } from '../control/index.js';
import type { SigilPaths } from './paths.js';
export interface UnlockOpts {
    paths: SigilPaths;
    /** Buffer holding the passphrase. Caller is responsible for zeroizing it. */
    passphrase: Buffer;
    /** Optional connect timeout in ms (default 5000). */
    timeoutMs?: number;
}
/**
 * Push an unlock to every running sigil-mcp session. Encodes the passphrase as
 * base64 for transport; does NOT clear the caller's buffer (the caller owns
 * lifetime). Returns the per-session outcomes — aggregate them with
 * {@link formatResult}.
 */
export declare function unlock(opts: UnlockOpts): Promise<SessionResult[]>;
export interface LockOpts {
    paths: SigilPaths;
    timeoutMs?: number;
}
export declare function lock(opts: LockOpts): Promise<SessionResult[]>;
/**
 * Aggregate per-session outcomes into a single human-readable line + exit code.
 *
 * Sessions that were reaped (stale sockets from dead processes) are ignored —
 * they don't count as reachable. If nothing was reachable, that's "not
 * running". A wrong passphrase fails uniformly (all sessions share the same
 * keyfiles), so any WRONG_PASSPHRASE short-circuits to exit 2. Otherwise we
 * report how many sessions ended up in the desired state, treating
 * ALREADY_UNLOCKED as a successful unlock.
 */
export declare function formatResult(action: 'unlock' | 'lock', sessions: SessionResult[]): {
    message: string;
    code: number;
};
//# sourceMappingURL=unlock.d.ts.map