import { GitvaultKeystore } from "./gitvault-keystore.js";
/** Where the mirror writes objects. Directory is a plain local (or network-mounted) path; S3 is `s3://<bucket>/<prefix>`. */
export type GitvaultMirrorDestination = {
    kind: "directory";
    path: string;
} | {
    kind: "s3";
    bucket: string;
    prefix: string;
    region: string;
    endpoint?: string;
};
/** How the S3 destination authenticates. Never a raw key — see the module doc. */
export type GitvaultMirrorCredential = {
    kind: "profile";
    profile: string;
} | {
    kind: "ambient";
};
/** `mirrors/<repo_id>.json` — the ONLY thing this file persists: where, which named credential to resolve at use time, and (gitvault-mirror-default) when a write/sync last fully succeeded. */
export interface GitvaultMirrorConfig {
    version: 1;
    repo_id: string;
    destination: GitvaultMirrorDestination;
    /** Present only for an `s3` destination — a directory destination needs no credential. */
    credential?: GitvaultMirrorCredential;
    /**
     * gitvault-mirror-default: when a mirror write or sync last completed with
     * zero failures against THIS destination — the local fact that clears the
     * `vault_unmirrored` finding. Stamped by the sync engine, reset when the
     * destination changes (a success against the old bucket says nothing about
     * the new one), and never transmitted anywhere (the gateway stays blind).
     */
    last_success_at?: string;
    created_at: string;
    updated_at: string;
}
export declare function mirrorsDir(keystore: GitvaultKeystore): string;
export declare function mirrorConfigPath(keystore: GitvaultKeystore, repoId: string): string;
/** Read the mirror config for one vault, or `null` when none is configured. */
export declare function readMirrorConfig(keystore: GitvaultKeystore, repoId: string): GitvaultMirrorConfig | null;
/** Every repo id with a mirror configured on this machine. */
export declare function listMirroredRepoIds(keystore: GitvaultKeystore): string[];
/** Set (create or replace) the mirror destination for one vault. */
export declare function saveMirrorConfig(keystore: GitvaultKeystore, input: {
    repo_id: string;
    destination: GitvaultMirrorDestination;
    credential?: GitvaultMirrorCredential;
}, now?: () => Date): GitvaultMirrorConfig;
/**
 * Stamp `last_success_at` after a zero-failure mirror write/sync
 * (gitvault-mirror-default) — the local, never-transmitted fact that clears
 * the `vault_unmirrored` finding. A no-op when no config exists (a
 * test-injected backend can sync without one), or when the config was removed
 * mid-sync.
 */
export declare function recordMirrorSuccess(keystore: GitvaultKeystore, repoId: string, now?: () => Date): GitvaultMirrorConfig | null;
/** Remove the mirror config for one vault. Never touches the mirror's own bytes — this only stops future pushes/syncs from targeting it. */
export declare function removeMirrorConfig(keystore: GitvaultKeystore, repoId: string): {
    removed: boolean;
};
/** Parse `s3://<bucket>/<prefix>` or a plain filesystem path into a {@link GitvaultMirrorDestination}. */
export declare function parseMirrorDestinationUrl(url: string, options?: {
    region?: string;
    endpoint?: string;
}): GitvaultMirrorDestination;
/** Render a destination back to the address form a human typed (for `status`/errors). */
export declare function formatMirrorDestination(destination: GitvaultMirrorDestination): string;
//# sourceMappingURL=gitvault-mirror-config.d.ts.map