/**
 * Daemon-owned domains that describe how the GROUP behaves, and therefore
 * replicate.
 *
 * Each entry is a ruling, and the reason is next to it. "The group should agree
 * on this" is the test; "this machine happens to need this" is not.
 */
export declare const REPLICATED_CONFIG_DOMAINS: readonly string[];
/**
 * Daemon-owned domains that are properties of a MACHINE, listed so the
 * classification test can prove every daemon-owned domain was ruled on rather
 * than merely omitted.
 *
 * These are the ones that would break a real install if they crossed the wire.
 */
export declare const NODE_LOCAL_CONFIG_DOMAINS: readonly string[];
/** Why a daemon-owned path is or is not replicated. */
export type ConfigReplicationClass = 'replicated' | 'node-local';
export interface ConfigPathClassification {
    readonly path: string;
    readonly replication: ConfigReplicationClass;
    /** Plain-language reason, surfaced by the classification test on failure. */
    readonly reason: string;
}
/** True when the schema marks this key a port. Ports never replicate. */
export declare function isPortConfigKey(path: string): boolean;
/**
 * Classify one daemon-owned path.
 *
 * Order matters: the structural port check runs FIRST, so a port that someone
 * later adds inside a replicated domain is still refused without anyone having
 * to remember to list it.
 */
/**
 * Daemon-owned keys ruled on individually because their DOMAIN goes the other
 * way.
 */
export declare const REPLICATED_CONFIG_KEYS: readonly string[];
export declare function classifyDaemonConfigPath(path: string): ConfigPathClassification;
/**
 * True when `path` may cross the network.
 *
 * The daemon-ownership check is not redundant with the domain check: it is what
 * makes a client or user preference unreachable from here no matter what the
 * domain lists say.
 */
export declare function isReplicatedConfigPath(path: string): boolean;
/** Every config path that replicates, in schema order. */
export declare function listReplicatedConfigPaths(): readonly string[];
/** Every daemon-owned path with its ruling. Used by the classification test. */
export declare function listDaemonConfigClassifications(): readonly ConfigPathClassification[];
/**
 * The secret-store name a config path implies.
 *
 * One implementation, in the config layer (`daemonSecretKeyFor`), because the
 * same derivation decides two things that must agree: which credential a
 * replicated path names, and which credential the daemon owns and therefore
 * stores in its own tier. This used to be a second copy of the rule, and a
 * second copy is a drift waiting to happen.
 */
export declare function replicatedSecretKeyFor(configPath: string): string;
/** Secret-store name → the replicated config path that named it. */
export declare function replicatedSecretKeys(): ReadonlyMap<string, string>;
/**
 * True when this secret-store key may cross the network.
 *
 * The group's own key material can never satisfy this: `cluster.` is
 * node-local, so no replicated config path derives `GOODVIBES_CLUSTER_*`, and a
 * secret nothing derives is a secret nothing can select.
 */
export declare function isReplicatedSecretKey(secretKey: string): boolean;
//# sourceMappingURL=config-replication-policy.d.ts.map