/**
 * `outposts replica-sync` — make a MANAGED box a full replica of the operator's HQ.
 *
 * A box provisioned via `outposts provision` runs this on a systemd timer:
 *   1. `hq auth refresh`          — freshen the seeded Cognito session
 *   2. `hq sync pull --personal`  — the personal vault (repos.yaml, policies, …)
 *   3. `hq rescue`                — re-lay the core kernel (needs `companies/`)
 *   4. clone `repos.yaml`         — the operator's OWN repos, gh-authed via vault
 *
 * Unlike `self-deploy` (a manual, unmanaged, all-company watcher on a box you
 * own), replica-sync is GENERIC: it works for every HQ user off their own personal
 * vault, with no per-operator setup script.
 *
 * It is deliberately best-effort end to end. A repeating timer must never leave
 * the systemd unit in `failed` just because one transient step — a mirror blip, a
 * not-yet-signed-in box — didn't complete this cycle. Every step logs its outcome
 * and the run continues.
 *
 * Node-only: shells out to `hq`, `git`, and `gh`, and probes the filesystem.
 */
import type { ReplicaSyncDependencies } from "./host-deps.js";
/** One repo entry resolved from `personal/data/repos.yaml`. */
export interface ReplicaRepo {
    url: string;
    visibility: "public" | "private";
    name: string;
}
/**
 * Parse `personal/data/repos.yaml` into a clone list.
 *
 * Mirrors `setup.sh`'s `clone_repos`: `visibility` defaults to public, `name`
 * defaults to the URL basename. Malformed entries are skipped rather than thrown,
 * so one bad row cannot stop the replica cycle.
 */
export declare function parseReposManifest(yamlText: string): ReplicaRepo[];
/** Run one replica cycle. Best-effort throughout — see the module doc comment. */
export declare function replicaSyncOutpost(opts: {
    hqRoot?: string;
}, deps: ReplicaSyncDependencies): Promise<void>;
//# sourceMappingURL=replica-sync.d.ts.map