import { type AuthProvider, type CompletionResult, type ParsedArgs, type SecretStore } from "@cotal-ai/core";
/** `cotal clean <history|store|all>` - one configurable cleanup verb.
 *   - `history`: purge the retained message backlog on the RUNNING broker (CHAT, plus DMs with
 *     `--dms`) via the least-privilege purger cred. `cotal history clear` is a thin alias.
 *   - `store`: delete the STOPPED mesh's JetStream store (`.cotal/nats` or `--store-dir`) - streams,
 *     durables, and messages. The reset for stale on-disk state (e.g. durables minted by an older,
 *     incompatible protocol generation).
 *   - `all`: `store` plus the space identity (`.cotal/auth`) and every local cred derived from it;
 *     the next `cotal up` mints a fresh identity.
 *  `history` needs the mesh UP (it is a live purge); `store`/`all` need it DOWN (files can't be
 *  deleted under a live server) and refuse loudly while any recorded process is still alive.
 *  Personas (`.cotal/agents`) are source and are never touched. */
export declare function clean(args: ParsedArgs): Promise<void>;
/** The live-purge half, shared with the `cotal history clear` alias. Resolves the running mesh (from
 *  any dir) + a least-privilege PURGER cred - `--creds` is a raw off-registry connect. Purge-only and
 *  destructive, so it mints exactly the purge grant (STREAM.PURGE on CHAT + DM), not the broad
 *  operator cred. In USER MODE the purge rides a one-shot "purger" VIEW bearer, exchange-gated on
 *  ledger scope "admin" (the refusal names the exact re-grant). */
export declare function purgeHistory(values: {
    server?: string;
    space?: string;
    creds?: string;
    dms?: boolean;
}): Promise<void>;
/** The recorded mesh process that may still be running under this root, as a "label, pid N" string -
 *  or undefined when everything is stopped. A stale pidfile (recorded pid proven dead) does not
 *  block: a crashed broker must not wedge its own cleanup. Liveness rides the shared hardened
 *  probe (`pidfileState`): pid > 0 only, EPERM counts as alive. */
export declare function liveMeshProcess(root: string, space?: string, settledByDown?: boolean): string | undefined;
/**
 * The possibly running process that makes this root the mesh's HOME, or undefined.
 *
 * Not "any Cotal process here": a manager, a delivery daemon or a web dashboard under this root can
 * perfectly well be pointed at a mesh running on another machine, and their liveness says nothing
 * about who owns the record. The BROKER is the mesh — and `clearsMesh` already marks it, because it
 * is the component whose teardown drops the registry entry (`down`). Asking the same question here
 * keeps "this mesh is running here, use `cotal down`" a true statement: found live against a real
 * registry, where a dashboard watching the remote optiplex mesh made `meshes rm` refuse and point
 * at a `cotal down` that would not have stopped that mesh at all.
 *
 * The controller stack this root recorded for the same space makes it the home too. `cotal up`
 * starts that stack's members as service instances with no pidfile, and `cotal down` stops them
 * together and drops the record. A member counts here while its process may still run. One proven
 * gone without its stop receipt does not, and {@link unsettledStackMembers} names it.
 */
export declare function liveMeshOwner(root: string, space?: string): string | undefined;
/** `space` names the tenant whose pidfiles to look at. Pass it whenever the caller already knows
 *  which mesh it means (a registry entry does): re-deriving it from the root can resolve a
 *  DIFFERENT tenant on a multi-space root, and the derivation throws outright on an unreadable or
 *  ambiguous one — a caller asking a yes/no liveness question should not inherit that failure.
 *  `settledByDown` is for the commands that remove the store, as {@link liveStackMembers} says. */
export declare function liveMeshProcesses(root: string, space?: string, settledByDown?: boolean): string[];
/** The members of the controller stack recorded at this root for `space` whose process is proven
 *  gone with no stop receipt: they can no longer run, but nothing stopped them cleanly. */
export declare function unsettledStackMembers(root: string, space: string): string[];
/** Fixed filesystem targets shared by native identity cleanup and its read-only impact plan. */
export declare function localIdentityCleanupTargets(root: string, space: string): {
    material: string;
    renewal: string;
    legacy: string[];
    runtime: string[];
    run: string;
    auth: string;
};
export interface ReviewedIdentityCleanup {
    store: SecretStore;
    provider: AuthProvider | null;
    agentKeys: readonly string[];
    beforeRemove(path: string): void;
    afterRemove(path: string): void;
}
/** Delete the stopped mesh's local state and return what was removed (paths relative to the root).
 *  `store`: the JetStream store directory. `all` adds the space identity (`.cotal/auth`), the
 *  locally persisted creds/markers tied to it - all invalid once the identity regenerates, and
 *  re-minted by the next fresh `cotal up` - plus crash residue a normal `down` would have swept
 *  (stale pidfiles, `run/`). Callers guard liveness first (`liveMeshProcess`).
 *
 *  MIGRATED SECRET KINDS are removed through the SecretStore seam FIRST — `delivery.creds` via
 *  its workspace key, the auth kinds via the registered provider's `deprovisionSecrets` — and a
 *  failure there THROWS BEFORE any raw removal of the local identity: wiping trust/IdP/ledger
 *  after a failed store delete would leave the store's old secrets authoritative over a freshly
 *  minted identity (split authority). The store deletes are idempotent, so a failed reset re-runs
 *  as-is, with `auth.json` still present to name the space. This surface stays the LOCAL
 *  filesystem composition (hosted resets ride the closed composition's own store + the same
 *  provider hook, never a KMS mode on this CLI). */
export declare function removeLocalState(root: string, opts: {
    includeAuth: boolean;
    storeDir?: string;
    space?: string;
    expectedStore?: {
        path: string;
        identity?: {
            dev: bigint;
            ino: bigint;
        };
    };
    onRemoved?: (label: string) => void;
    identity?: ReviewedIdentityCleanup;
}): Promise<string[]>;
/** Inspect the same pinned local store path that the existing guarded cleanup deletes. */
export declare function safeStoreCleanupPath(root: string, override: string | undefined): {
    path: string;
    identity?: {
        dev: bigint;
        ino: bigint;
    };
};
export declare function cleanComplete(argv: string[]): CompletionResult;
//# sourceMappingURL=clean.d.ts.map