/**
 * Dual-write helpers — Phase 5 of the secrets refactor.
 *
 * Every legacy writer of a configuration file (user.json, workspace.json,
 * connectors/*.json) also mirrors the registry-mapped fields into the
 * encrypted store. The legacy file remains authoritative through Phase 5;
 * Phase 6 flipped the read path so the store is the source of truth at
 * read time.
 *
 * Failure modes are deliberately non-fatal: a dropped dual-write must
 * never block the legacy write, because the file is still the source of
 * truth. Failures route to `console.warn` for now — Phase 11 swaps in the
 * sanitizing log wrapper.
 *
 * Idempotency is provided by the store itself: writes use INSERT … ON
 * CONFLICT DO UPDATE, so writing the same key twice yields a single row
 * whose `updated_at` advances.
 *
 * `looksLikeEnvPlaceholder()` filters `$ENV_VAR` strings out — connector
 * configs use those as placeholders, and the literal `$FOO_AUTH` is not
 * actually a credential value worth mirroring into the store.
 *
 * After the scope-collapse refactor, the store is single-tier (the
 * process IS the workspace), so the mirror helpers no longer thread a
 * scope or scopeId — every write lands in the single secrets.db.
 */
import type { ActorContext } from './SecretStore.js';
/**
 * Returns true when the store singleton was successfully initialized at
 * boot. Every dual-write entry point guards on this before touching the
 * store. Historically gated on the `STUDIOGRAPH_NEW_STORE` env flag too;
 * the flag was removed once Phase 6 stabilized in production.
 */
export declare function dualWriteEnabled(): boolean;
interface MirrorContext {
    actor: ActorContext;
}
/**
 * Dual-write `user.json` fields into the encrypted store. The mapping
 * from user.json path → registry key is inlined below; Phase 12b
 * (2026-05-12) dropped the registry's `migrationSource` annotation
 * that used to drive this iteration, since it was the annotation's
 * sole remaining consumer (the importer was removed in Phase 12a).
 *
 * The actor is `{ type: 'system', systemId: 'dual-write' }` because the
 * caller is a file writer, not a user action; UI-driven changes that
 * route through the Phase 7 APIs supply a real user actor.
 */
export declare function mirrorUserConfig(config: unknown, ctx?: MirrorContext): Promise<void>;
/**
 * Dual-write a connector config. Iterates the connector-secret registry
 * entries and resolves their paths under the specific connector's config
 * (e.g., `headers.Authorization` → `connector.<name>.auth`).
 *
 * The registry uses pattern names like `connector.<name>.auth`; we expand
 * to a concrete key per connector at write time. `<name>` is the connector
 * name verbatim, lowercased for stability — connector names are already
 * url-safe slugs per `parseConfigBlock`.
 */
export declare function mirrorConnectorConfig(config: {
    name: string;
    headers?: Record<string, string>;
    oauth?: {
        client_secret?: string;
    };
} & Record<string, unknown>, ctx?: MirrorContext): Promise<void>;
/**
 * Dual-write workspace.json into the store. Covers the R2 credentials
 * (always-secret), the three R2 structural fields (workspace-setting,
 * added 2026-05-12 so the Settings UI can fully configure R2), and the
 * legacy search.* block.
 *
 * Why structural fields dual-write too: post-2026-05-12 the store is
 * the source of truth for R2 structural config, but `studiograph r2
 * setup` (and any other workspace.writeConfig caller) still writes the
 * file. Without this mirror, every CLI invocation would silently leave
 * the store stale. Pair this with the one-shot r2-structural-migration
 * that covers the first-boot case.
 */
export declare function mirrorWorkspaceConfig(config: unknown, ctx?: MirrorContext): Promise<void>;
export {};
