export declare function takeOverStdout(): void;
export declare function restoreStdout(): void;
export declare function isStdoutTakenOver(): boolean;
/** Hand a small control frame directly to the OS pipe before synchronous user code begins. */
export declare function writeRawStdoutControl(text: string): void;
export declare function writeRawStdout(text: string): void;
/**
 * A `writeRawStdoutOnce` failure, carrying how much of the payload reached the
 * stream.
 *
 * `emitted` is the answer the credential egress needs, and "some" is a distinct
 * answer from "all": bytes that escaped cannot be recalled, but a caller told
 * only that *something* left would report a truncated secret as a whole one.
 *
 *   - `"none"` — the write call threw before the stream accepted anything, or
 *     the callback failed with `bytesWritten` unmoved, so the chunk was
 *     buffered and dropped without a syscall. stdout is provably empty.
 *   - `"partial"` — the counter advanced by less than the payload. stdout
 *     carries a fragment, which is not a usable credential.
 *   - `"all"` — the counter advanced by the whole payload and the failure came
 *     after. stdout carries the credential.
 *
 * `bytesWritten` exists on the socket stdout is when it is a TTY or a pipe. A
 * file redirect gets `SyncWriteStream`, which has no counter and writes
 * synchronously — there a callback error means the `writeSync` itself failed,
 * so nothing was emitted.
 */
export type RawStdoutEmission = "none" | "partial" | "all";
export declare class RawStdoutWriteError extends Error {
    readonly emitted: RawStdoutEmission;
    constructor(message: string, options: {
        cause: unknown;
        emitted: RawStdoutEmission;
    });
}
/**
 * Write one chunk to the real stdout as a single awaited operation.
 *
 * Differs from `writeRawStdout` in the two ways the credential egress needs.
 * The rejection reaches the caller instead of exiting the process, so the
 * caller can report a cause of its own. And the chunk is handed to stdout
 * exactly once — the ENOBUFS/EAGAIN retry in `writeRawStdoutChunk` would
 * re-send the whole payload, which for a secret risks emitting it twice.
 *
 * Rejects with `RawStdoutWriteError`, whose `emitted` says how much left. A
 * caller that must never report a failure over a stream carrying a whole
 * credential — nor claim success over one carrying none of it, nor part of it —
 * branches on that rather than on the presence of an error.
 */
export declare function writeRawStdoutOnce(text: string): Promise<void>;
export declare function waitForRawStdoutBackpressure(): Promise<void>;
export declare function flushRawStdout(): Promise<void>;
//# sourceMappingURL=output-guard.d.ts.map