import { type PushBundleResult } from './push.js';
import { type DeviceProfile } from '../devices/registry.js';
import { type SharedAuthStatus } from '../fleet-shared-state.js';
/** Each import/read-back SSH operation gets this deadline plus the SSH hard-kill grace. */
export declare const AUTH_SYNC_PUSH_DEADLINE_MS = 20000;
export interface AuthSyncDevice {
    name: string;
    reachable: boolean;
    pinned: boolean;
    remoteAuth: SharedAuthStatus | 'unknown';
}
export type AuthSyncPlanItem = {
    action: 'push';
    device: string;
} | {
    action: 'skip';
    device: string;
    reason: string;
};
export declare function planAuthBundlePush(localAuthOk: boolean, localIsPublisher: boolean, devices: AuthSyncDevice[]): AuthSyncPlanItem[];
export interface AuthSyncResult {
    publisher: string | null;
    stateChanged: boolean;
    pushed: string[];
    skipped: Array<{
        device: string;
        reason: string;
    }>;
    errors: Array<{
        device: string;
        message: string;
    }>;
}
export interface AuthSyncDeps {
    inspectLocal?: () => {
        exists: boolean;
        ok: boolean;
    };
    listDevices?: () => DeviceProfile[];
    localName?: string;
    userAgentsDir?: string;
    isPinned?: (name: string) => boolean;
    push?: (bundle: string, host: string) => Promise<PushBundleResult>;
    sshTarget?: (device: DeviceProfile) => string;
}
export interface PublishAuthVerdictOptions {
    inspectLocal?: () => {
        exists: boolean;
        ok: boolean;
    };
    localName?: string;
    userAgentsDir?: string;
}
export interface PublishAuthVerdictResult {
    device: string;
    status: SharedAuthStatus;
    changed: boolean;
    error: string | null;
}
/** Publish only safe readiness metadata; useful immediately before a repo push. */
export declare function publishReservedAuthVerdict(options?: PublishAuthVerdictOptions): Promise<PublishAuthVerdictResult>;
/**
 * Publish local readiness, elect one ready source, then asynchronously provision
 * only peers whose shared verdict says the bundle is missing.
 */
export declare function syncReservedAuthBundle(deps?: AuthSyncDeps): Promise<AuthSyncResult>;
