/**
 * Remote sync for secrets bundles — backend-agnostic.
 *
 * Replaces the previous "leave it to iCloud Keychain" model with explicit
 * push/pull. Bundle contents (vars + secret values) are encrypted client-side
 * with AES-256-GCM under a key derived from a user-supplied passphrase via
 * PBKDF2-SHA256; only the resulting ciphertext envelope is handed to the
 * transport. The transport itself is a pluggable `SyncBackend` (see
 * `sync-backend.ts`) — the Rush driver (`drivers/rush.ts`, api.prix.dev) is the
 * default for backwards compatibility, swappable via `setSyncBackend`. Plaintext
 * never leaves this module; the backend only ever sees ciphertext + KDF params.
 */
import { type SecretsBundle } from './bundles.js';
import type { SyncBackend, RemoteBundleSummary, EncryptedEnvelope } from './sync-backend.js';
export type { EncryptedEnvelope, RemoteBundleSummary } from './sync-backend.js';
export declare const MIN_PASSPHRASE_LEN = 12;
/** Override the sync transport. Returns the previous backend (restore in tests). */
export declare function setSyncBackend(next: SyncBackend): SyncBackend;
/** Encrypt a JSON-serializable payload with a passphrase. */
export declare function encryptBlob(plaintext: string, passphrase: string): EncryptedEnvelope;
/** Decrypt an envelope. Throws on bad passphrase (auth tag mismatch). */
export declare function decryptBlob(envelope: EncryptedEnvelope, passphrase: string): string;
/** The plaintext we serialize before encrypting: bundle metadata + secret values. */
export interface BundleSnapshot {
    bundle: SecretsBundle;
    /** keychain shortId -> plaintext value. Only present for keychain: refs. */
    secrets: Record<string, string>;
}
/** Options for pushBundle. */
export interface PushOptions {
    passphrase: string;
}
/** Push a local bundle to the remote. Encrypts client-side; the backend only sees ciphertext. */
export declare function pushBundle(name: string, opts: PushOptions): Promise<{
    updated_at: string;
}>;
/** Options for pullBundle. */
export interface PullOptions {
    passphrase: string;
    /** When true, overwrite an existing local bundle. */
    force?: boolean;
}
/** Pull a bundle by name from the remote and materialize it locally. */
export declare function pullBundle(name: string, opts: PullOptions): Promise<SecretsBundle>;
/** Delete a bundle on the remote. */
export declare function deleteRemoteBundle(name: string): Promise<boolean>;
/** List bundles currently stored on the remote for this user. */
export declare function listRemoteBundles(): Promise<RemoteBundleSummary[]>;
