/**
 * This machine's cloud vault state (`<cleoHome>/nexus-vault.json`):
 * secret-free, machine-local bookkeeping the vault needs between runs.
 *
 * - Per account: the signer {@link TrustState} learned from
 *   `certifiedSigners` (trust only tightens, so it must survive restarts).
 * - Per (stream, local store): the snapshot this store last pushed or
 *   restored, which decides "behind" (another device pushed since) and
 *   "pending changes" (this store changed since).
 *
 * Every read-modify-write runs under a lock file and writes atomically (temp
 * file + rename). A file this version cannot read (truncated, invalid, or
 * written by a newer CLEO) is moved aside with a warning, never reset in
 * place, so a downgrade or a torn write cannot silently discard the signer
 * pins. Nothing here is secret: keys and tokens stay in the sealed device
 * store.
 *
 * @task T12336
 * @epic T12322
 */
import type { CloudWarning } from '@cleocode/contracts';
import { z } from 'zod';
import { type TrustState } from './keys.js';
declare const streamStateSchema: z.ZodObject<{
    /** The snapshot this store last pushed or restored. */
    lastCheckpointId: z.ZodNullable<z.ZodString>;
    /** Its coversSeq: an older snapshot is never restored over it without `--checkpoint`. */
    lastCoversSeq: z.ZodNumber;
    updatedAt: z.ZodString;
    /**
     * A push from this store that had not recorded its snapshot yet: the parent it
     * pushed over (T13007). Cleared when the snapshot is recorded.
     */
    pushInFlight: z.ZodOptional<z.ZodObject<{
        parentCheckpointId: z.ZodNullable<z.ZodString>;
        at: z.ZodString;
        gitTracked: z.ZodOptional<z.ZodArray<z.ZodString>>;
        files: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    }, z.core.$strip>>;
    /**
     * Paths (relative to the section root) the last synced snapshot marks as
     * git-tracked: git's job, so they are left out of every file comparison
     * with it, and a machine without git carries the marks on (T13019).
     */
    gitTracked: z.ZodOptional<z.ZodArray<z.ZodString>>;
    /**
     * The last synced snapshot's plain files, path to digest (a prefix of the
     * vault file digest), so a later comparison judges each file on its own,
     * whatever either side's git tracks (T13038).
     */
    files: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
}, z.core.$loose>;
/** What a store last synced with on a stream. */
export type VaultStreamState = z.infer<typeof streamStateSchema>;
/** Key of one local store on one stream. */
export declare const vaultStreamKey: (streamId: string, storeRoot: string) => string;
/** Warning code: the state file was unreadable or newer, and was moved aside. */
export declare const W_NEXUS_VAULT_STATE_MOVED = "W_NEXUS_VAULT_STATE_MOVED";
/**
 * Read/modify/write access to the vault state file.
 */
export declare class NexusVaultState {
    /** Absolute path of the state file. */
    readonly path: string;
    private warnings;
    /** @param filePath - Override for tests; defaults to {@link resolveNexusVaultStatePath}. */
    constructor(filePath?: string);
    /** Warnings raised since the last call (a moved-aside file), for the command's result. */
    drainWarnings(): CloudWarning[];
    /** Run `fn` holding the state file's lock. */
    private locked;
    /** Move an unusable file aside (never overwrite it) and start empty. */
    private moveAside;
    private read;
    private write;
    /** Read, let `fn` change the state, and write it back, all under the lock. */
    private update;
    /** Read under the lock (moving an unusable file aside). */
    private snapshot;
    private account;
    /** The account's persisted signer trust state. */
    trust(apiUrl: string, userId: string): TrustState;
    /** Persist the trust state returned by `certifiedSigners`. */
    saveTrust(apiUrl: string, userId: string, trust: TrustState): void;
    /**
     * Read the account's trust state, let `fn` evaluate it, and persist the
     * trust it returns, all under one lock.
     *
     * @param apiUrl - Account API URL.
     * @param userId - Account user id.
     * @param fn - Receives the current trust; returns the trust to store and a result.
     * @returns `fn`'s result.
     */
    updateTrust<T>(apiUrl: string, userId: string, fn: (current: TrustState) => {
        trust: TrustState;
        result: T;
    }): T;
    /** What `storeRoot` last synced with on `streamId`, or `null`. */
    stream(apiUrl: string, userId: string, streamId: string, storeRoot: string): VaultStreamState | null;
    /**
     * Record that a push from `storeRoot` is about to create a snapshot over
     * `parentCheckpointId` (T13007). {@link saveStream} clears the mark; when a
     * crash loses that write, the mark tells the next command that the head
     * this device and replica pushed over that parent is this store's own, and
     * what that snapshot marks and holds (`pushed`), so recovering it loses no
     * per-path digest.
     */
    markPushInFlight(apiUrl: string, userId: string, streamId: string, storeRoot: string, parentCheckpointId: string | null, pushed?: {
        gitTracked?: readonly string[];
        files?: Readonly<Record<string, string>>;
    }): void;
    /** Record that `storeRoot` now holds `checkpointId` on `streamId`. */
    saveStream(apiUrl: string, userId: string, streamId: string, storeRoot: string, value: {
        lastCheckpointId: string;
        lastCoversSeq: number;
        gitTracked?: readonly string[];
        files?: Readonly<Record<string, string>>;
    }): void;
}
export {};
//# sourceMappingURL=nexus-vault-state.d.ts.map