/**
 * studiograph admin backup — produce a passphrase-wrapped, manifest-aware
 * snapshot of the entire local workspace.
 *
 * Pairs with `admin restore`. Distinct from `clone`:
 *   - `clone` pulls from a running server; strips machine-specific config
 *     (r2_config, railway, master-key, JWT secret); good for setting up
 *     a new dev machine.
 *   - `admin backup` snapshots the local workspace; includes secrets.db,
 *     auth.db, r2_config, railway IDs, and a manifest of the Railway env
 *     vars (master key, JWT secret) the owner provides at backup time;
 *     good for "server is dead, restore me."
 *
 * Bundle contents (encrypted as a single .sgbackup file):
 *   - manifest.json — env-var values + Railway IDs + workspace name + ts
 *   - workspace/ — tar of the workspace directory, minus
 *     node_modules/, .DS_Store, and any *.log files
 *
 * Crypto: passphrase → scrypt → key → xchacha20poly1305(tar.gz).
 * See [src/cli/crypto-bundle.ts] for the wire format.
 *
 * Refuses to write the bundle to a destination directory unless it
 * exists with mode 0700, or is being created (we make it 0700). Bundle
 * file is written with mode 0600. Defense against world-readable backups
 * that contain bcrypt hashes from auth.db.
 */
import { Command } from 'commander';
interface BackupManifest {
    workspace_name: string;
    created_at: string;
    format_version: 1;
    /** Railway-side env vars the operator supplied at backup time. The
     *  backup intentionally re-prompts for these (rather than reading from
     *  the workspace's secrets.db) so a single passphrase-wrapped bundle
     *  carries everything restore needs. */
    env: {
        STUDIOGRAPH_MASTER_KEY: string;
        STUDIOGRAPH_JWT_SECRET: string;
    };
    /** Railway link, if any. Each field is optional in workspace.json
     *  schema, so the manifest carries them as optional too — restore
     *  reports the gap if a value is missing rather than rejecting the
     *  whole bundle. */
    railway?: {
        project_id?: string;
        service_id?: string;
        environment_id?: string;
    };
    /** Cosmetic only — restore uses this to print "this bundle is from
     *  workspace X, created Y". Does not affect the restore behavior. */
    notes?: string;
}
export declare const adminBackupCommand: Command;
export type { BackupManifest };
