export type MigrationResult = "migrated" | "noop" | "skipped";
export interface KeyringBackend {
    setPassword(service: string, account: string, password: string): void;
    getPassword(service: string, account: string): string | null;
    deletePassword(service: string, account: string): boolean;
}
export interface MigrationFsAdapter {
    existsSync: (p: string) => boolean;
    readFileSync: (p: string) => string;
    writeFileSync: (p: string, content: string) => void;
    mkdirSync: (p: string) => void;
    unlinkSync: (p: string) => void;
    statSync: (p: string) => {
        mtimeMs: number;
    };
}
export interface MigrationDeps {
    keyring: KeyringBackend | null;
    fs?: MigrationFsAdapter;
    now?: () => number;
    homeDir?: string;
}
/**
 * Runs the legacy → canonical migration with mutex serialization.
 *
 * Returns:
 *   - 'migrated' — token moved (or both slots cleaned up)
 *   - 'noop'     — nothing to migrate; done flag written
 *   - 'skipped'  — environment opt-out, missing keyring, done flag, or
 *                  another runner holds a fresh lock
 *
 * Idempotent — running twice is safe (the second call sees the done flag
 * and returns 'skipped').
 */
export declare function runKeychainMigration(deps: MigrationDeps): MigrationResult;