/**
 * Portable-secret values on the home stream (journal spec §2.5 phase A and
 * §2.7; T13467, owner design `cleo docs fetch t13467-global-secrets-sync-design`).
 *
 * Everything here awaits (the machine-key decrypt and re-encrypt are async), so
 * it runs only inside `cloud sync`, which holds the master key, and never inside
 * a transaction or on the store-open path:
 *
 * - {@link prepareSecretSeals} (sender, phase A): reads each live secret value
 *   of a {@link SEALED_SECRET_TABLES} row with pending captures, decrypts a
 *   machine-key credential column to its plaintext, and seals it under
 *   `deriveKey(masterKey, 'secret-values')` with the AAD `table\nuid\ncolumn`.
 *   The sealer's phase B swaps each `<changed>` marker for its sealed value.
 * - {@link prepareSecretOpens} (receiver): opens each staged sealed value and
 *   re-encrypts a credential column under THIS machine's key before the apply
 *   frame opens; the applier writes the finished value.
 *
 * A device that is not logged in never reaches either step: its captures stay
 * pending and its inbox holds the sealed ops.
 *
 * @task T13467
 */
import type { DatabaseSync } from 'node:sqlite';
import type { CloudWarning, TableScope } from '@cleocode/contracts';
import type { LedgerWireValue } from '@cleocode/contracts/ledger';
import { type SecretSeals } from '../store/sync/sealer.js';
import { type SealedCredentialCell } from '../store/vault-manifest.js';
/**
 * The secret-values key (§2.7), derived from the account master key.
 *
 * @param masterKey - The account master key (32 bytes).
 * @returns The key secret values are sealed under.
 */
export declare function secretValuesKey(masterKey: Uint8Array): Buffer;
/** Options for both phases. */
export interface SecretSealOptions {
    /** The CLEO home whose machine key encrypts credentials. @defaultValue the current home */
    readonly cleoHome?: string;
    /** Receives a warning for each value phase A could not read (T13532). */
    readonly warn?: (warning: CloudWarning) => void;
}
/**
 * Phase A (§2.5): seal every live secret value the pending captures of
 * {@link SEALED_SECRET_TABLES} rows will send. Read-only on the store. A value
 * this machine's key cannot decrypt (a restored or copied store, a rotated key)
 * is left out with a `W_SYNC_SECRET_UNREADABLE` warning: its group stays
 * pending, and every other row still seals (T13532).
 *
 * @param db - The store.
 * @param scope - Its scope.
 * @param secretKey - {@link secretValuesKey} of the account master key.
 * @param opts - Machine-key options.
 * @returns The sealed values, for `sealPending({ secrets })`.
 */
export declare function prepareSecretSeals(db: DatabaseSync, scope: TableScope, secretKey: Uint8Array, opts?: SecretSealOptions): Promise<SecretSeals>;
/**
 * The receiver's half (§2.7): open every sealed secret value staged on
 * `stream` and re-encrypt each credential column under this machine's key.
 * A value that does not open (another account's key) is left out, so its op
 * holds.
 *
 * @param db - The store.
 * @param scope - Its scope.
 * @param stream - The stream whose staged transactions to open.
 * @param secretKey - {@link secretValuesKey} of the account master key.
 * @param opts - Machine-key options.
 * @returns The opened values, for `applyStagedTxns({ secrets })`.
 */
export declare function prepareSecretOpens(db: DatabaseSync, scope: TableScope, stream: string, secretKey: Uint8Array, opts?: SecretSealOptions): Promise<ReadonlyMap<string, LedgerWireValue>>;
/**
 * The vault snapshot's half (T13530): seal every credential cell of a staged
 * snapshot under the secret-values key before the export clears it, so a
 * device restoring the snapshot (a genesis join) gets usable credentials. Each
 * value is decrypted with this machine's key and sealed with the AAD
 * `table\nuid\ncolumn`, exactly as phase A seals it. A value this machine
 * cannot decrypt is left out with a `W_SYNC_SECRET_UNREADABLE` warning.
 *
 * @param snapshotPath - The export's staged snapshot of the global store.
 * @param secretKey - {@link secretValuesKey} of the account master key.
 * @param opts - Machine-key options.
 * @returns The sealed cells, for the snapshot's sealed-credentials table.
 */
export declare function sealSnapshotCredentials(snapshotPath: string, secretKey: Uint8Array, opts?: SecretSealOptions): Promise<SealedCredentialCell[]>;
/**
 * The restore's half (T13530): open every sealed credential cell a staged
 * vault snapshot carries, re-encrypt it under THIS machine's key, and fill
 * the cells still NULL after the machine state was carried (a local value
 * wins). The sealed-credentials table is dropped either way. A cell that does
 * not open (another account's key) or names no credential column stays NULL.
 * Any path that places a vault checkpoint's store calls this on its staged
 * copy first: the vault restore does, and so must the merge join's scratch
 * restore (#2080, `reconcileOwedCopy`).
 *
 * @param stagedDbPath - The restore's staged snapshot of the global store.
 * @param secretKey - {@link secretValuesKey} of the account master key.
 * @param opts - Machine-key options.
 * @returns The cells filled.
 */
export declare function openSnapshotCredentials(stagedDbPath: string, secretKey: Uint8Array, opts?: SecretSealOptions): Promise<number>;
//# sourceMappingURL=secret-seal.d.ts.map