import { type FlagClient, type FlagClientOptions } from "@indigoai-us/hq-flags-client";
import type { VaultServiceConfig } from "../types.js";
export declare const SKIP_SECRET_PATHS_FLAG = "sync.skip-secret-paths";
type FlagClientFactory = (options: FlagClientOptions) => FlagClient;
type GateDependencies = {
    createClient?: FlagClientFactory;
    env?: Readonly<{
        HQ_FLAGS_API_URL?: string;
    }>;
    now?: () => number;
};
/**
 * Match vault-relative secret-bearing keys. `secrets/` means a directory named
 * `secrets` at any depth; the credentials rule follows gitignore-style `**`,
 * so both `credentials/tokens.json` and deeper token files match.
 */
export declare function isSecretBearingVaultPath(relativePath: string): boolean;
/**
 * Resolve the default-off company flag before a sync pass plans transfers.
 * The initial refresh is awaited (the flag controls which bytes may be
 * uploaded); later passes reuse the last successful value for five minutes.
 * A missing row or failed first read defaults off unless a pre-vended caller
 * requests fail-closed handling; later refresh failures preserve the last value.
 */
export declare function createSkipSecretPathsGate(dependencies?: GateDependencies): (config: VaultServiceConfig, companyUid: string, failClosed?: boolean) => Promise<boolean>;
export declare function isSkipSecretPathsEnabled(config: VaultServiceConfig, companyUid: string, 
/** Return true until the first successful snapshot when no flag config is available. */
failClosed?: boolean): Promise<boolean>;
export {};
//# sourceMappingURL=secret-path-policy.d.ts.map