import { VaultKeystore } from "./vault-keystore.js";
/** Where the mirror writes objects. Directory is a plain local (or network-mounted) path; S3 is `s3://<bucket>/<prefix>`. */
export type VaultMirrorDestination = {
    kind: "directory";
    path: string;
} | {
    kind: "s3";
    bucket: string;
    prefix: string;
    region: string;
    endpoint?: string;
};
/** How the S3 destination authenticates. Never a raw key — see the module doc. */
export type VaultMirrorCredential = {
    kind: "profile";
    profile: string;
} | {
    kind: "ambient";
};
/** `mirrors/<repo_id>.json` — the ONLY thing this file persists: where, which named credential to resolve at use time, and (vault-mirror-default) when a write/sync last fully succeeded. */
export interface VaultMirrorConfig {
    version: 1;
    repo_id: string;
    destination: VaultMirrorDestination;
    /** Present only for an `s3` destination — a directory destination needs no credential. */
    credential?: VaultMirrorCredential;
    /**
     * vault-mirror-default: when a mirror write or sync last completed with
     * zero failures against THIS destination — the local fact that clears the
     * `vault_unmirrored` finding. Stamped by the sync engine, reset when the
     * destination changes (a success against the old bucket says nothing about
     * the new one), and never transmitted anywhere (the gateway stays blind).
     */
    last_success_at?: string;
    created_at: string;
    updated_at: string;
}
export declare function mirrorsDir(keystore: VaultKeystore): string;
export declare function mirrorConfigPath(keystore: VaultKeystore, repoId: string): string;
/** Read the mirror config for one vault, or `null` when none is configured. */
export declare function readMirrorConfig(keystore: VaultKeystore, repoId: string): VaultMirrorConfig | null;
/** Every repo id with a mirror configured on this machine. */
export declare function listMirroredRepoIds(keystore: VaultKeystore): string[];
/** Set (create or replace) the mirror destination for one vault. */
export declare function saveMirrorConfig(keystore: VaultKeystore, input: {
    repo_id: string;
    destination: VaultMirrorDestination;
    credential?: VaultMirrorCredential;
}, now?: () => Date): VaultMirrorConfig;
/**
 * Stamp `last_success_at` after a zero-failure mirror write/sync
 * (vault-mirror-default) — the local, never-transmitted fact that clears
 * the `vault_unmirrored` finding. A no-op when no config exists (a
 * test-injected backend can sync without one), or when the config was removed
 * mid-sync.
 */
export declare function recordMirrorSuccess(keystore: VaultKeystore, repoId: string, now?: () => Date): VaultMirrorConfig | null;
/** Remove the mirror config for one vault. Never touches the mirror's own bytes — this only stops future pushes/syncs from targeting it. */
export declare function removeMirrorConfig(keystore: VaultKeystore, repoId: string): {
    removed: boolean;
};
/** Parse `s3://<bucket>/<prefix>` or a plain filesystem path into a {@link VaultMirrorDestination}. */
export declare function parseMirrorDestinationUrl(url: string, options?: {
    region?: string;
    endpoint?: string;
}): VaultMirrorDestination;
/** Render a destination back to the address form a human typed (for `status`/errors). */
export declare function formatMirrorDestination(destination: VaultMirrorDestination): string;
//# sourceMappingURL=vault-mirror-config.d.ts.map