/**
 * Umbrella `agents sync` orchestration — "make this machine current".
 *
 * Bare `agents sync` fetches the config repos then reconciles them into every
 * installed agent's version home. Secrets are an opt-in stage (`--secrets`) —
 * see `planUmbrellaStages` for why it's off by default. Each stage is an
 * existing exported library function; this module only sequences them and
 * decides — from the flags — which stages run. The planner is pure so the
 * flag matrix is unit-tested without any I/O.
 *
 * Stage backends:
 *   repos    -> git pull of ~/.agents + enabled ~/.agents-* extras (pullRepo)
 *   secrets  -> listRemoteBundles + pullBundle (needs a passphrase; skipped
 *               cleanly when none is available — tokenized non-interactive auth
 *               arrives with `agents secrets vault unlock`, #366/#367)
 *   reconcile-> refresh({ skipPrompts }) — re-materialize resources into homes
 */
/** The umbrella flags off `agents sync`. */
export interface UmbrellaFlags {
    repos?: boolean;
    secrets?: boolean;
    cloud?: boolean;
    local?: boolean;
}
/** Which stages a given flag combination runs. */
export interface UmbrellaPlan {
    fetchRepos: boolean;
    fetchSecrets: boolean;
    reconcile: boolean;
}
/**
 * Decide which stages run. Pure — no I/O. Semantics:
 *   bare (no flags)        fetch repos, then reconcile
 *   --local                reconcile only, no fetch
 *   --cloud                fetch repos (or the selected subset), skip reconcile
 *   --repos/--secrets      fetch only the selected types, then reconcile
 * `--local` wins over everything; `--cloud` suppresses reconcile.
 *
 * Secrets are NOT part of the bare default — they are opt-in via `--secrets`.
 * Pulling every secret bundle onto the machine on a bare `agents sync` is more
 * blast radius than the verb should carry by default.
 */
export declare function planUmbrellaStages(f: UmbrellaFlags): UmbrellaPlan;
export interface UmbrellaResult {
    plan: UmbrellaPlan;
    repos?: {
        pulled: number;
        errors: string[];
    };
    secrets?: {
        pulled: number;
        skipped: boolean;
        reason?: string;
        errors: string[];
    };
    devices?: {
        synced: number;
        pending: number;
        skipped: boolean;
    };
    reconciled: boolean;
    /**
     * Resources the reconcile stage refused to write, as user-facing sentences.
     * Empty when nothing was declined — never conflated with "nothing to do".
     */
    declined: string[];
    /**
     * The (agent, version) pairs the reconcile stage actually wrote into — the set
     * the caller re-verifies for residual drift so the `✓ sync: reconciled` line is
     * never printed while drift it was asked to fix stays put (PHNX-3186).
     */
    reconciledVersions: Array<{
        agent: string;
        version: string;
    }>;
}
export interface RunUmbrellaArgs {
    flags: UmbrellaFlags;
    /** Progress sink (already quiet-aware in the caller). */
    log: (msg: string) => void;
    /** Pass `skipPrompts` through to reconcile / non-interactive behavior. */
    yes: boolean;
    /** Secrets passphrase, if available (env var or prompt). Undefined => skip secrets. */
    passphrase?: string;
    /**
     * Suppress human progress from the reconcile stage (`refresh`). Required so
     * `agents sync --json` / fleet fan-out leave stdout as a single JSON object.
     */
    quiet?: boolean;
}
/**
 * Execute the planned stages in order: repos -> secrets -> reconcile.
 * A failure in one fetch stage is recorded and does not abort the others or the
 * reconcile — `agents sync` should make as much current as it can in one pass.
 */
export declare function runUmbrellaSync(args: RunUmbrellaArgs): Promise<UmbrellaResult>;
