import { type CompletionResult, type ParsedArgs } from "@cotal-ai/core";
import { type LocalProcess, type LocalProcessContext, type MaintenanceResumeDescriptor, type SeatCheckpoint } from "@cotal-ai/workspace";
import { type Presence } from "@cotal-ai/core";
/** Complete selective component names without importing installed packages. */
export declare function downComplete(argv: string[]): CompletionResult;
/** Named stops use only the owned-service controller. Multiple definitions require complete
 *  set selection, reservation and impact preflight. Legacy bare-stack integration stays separate. */
export declare function validateDownArguments(args: ParsedArgs): void;
/** `cotal down`. It owns stdout's errors for its whole run, so a reader that goes away, as with
 *  `| head -1`, no longer ends it between a member's stop request and that stop's confirmation. The
 *  stop runs to its end, and the exit status is the stop's own. */
export declare function down(args: ParsedArgs): Promise<void>;
export declare const isAlive: (pid: number) => boolean;
export declare function processAlive(component: LocalProcess, context: LocalProcessContext): boolean;
/** Whether a component MIGHT still be running. It fails CLOSED on uncertainty. A component with NO
 *  pidfile, an EMPTY husk, or a valid pid PROVEN dead (ESRCH) is not running. ANY other state - an
 *  unparsable/unattributable record, or a valid pid that is alive or whose liveness cannot be
 *  confirmed (`unknown`) - MIGHT be running. `down --preserve-state` asks it to fence an uncertain
 *  delivery daemon, to treat an uncertain manager as alive, and to refuse to call a cut complete.
 *  `processAlive` collapses unparsable and `unknown` to "not alive", which is fine for "is it worth
 *  stopping" but WRONG for those questions: it would count a live auth signer behind a torn pidfile
 *  as stopped. Only an ESRCH-confirmed death (or no record) clears a component. */
export declare function mayBeRunning(component: LocalProcess, context: LocalProcessContext): boolean;
/** The principal keys of every retained agent in a preservation inventory — the dot-form ids that
 *  appear in the presence roster, so a caller can tell which retained agents are still live. */
export declare function retainedPrincipalKeys(inventory: unknown): Set<string>;
/**
 * Refuse any seat the cut could not checkpoint, from the prepared inventory alone.
 *
 * Called at prepare time, before a single child is stopped. The capture itself must wait until the
 * stack is proven down, but the DECISION about whether a capture is possible reads only the
 * inventory, so it belongs where the operator still has a running mesh.
 *
 * A seat the manager would refuse to resume is refused here too, with the manager's own wording:
 * `Manager.inventoryReferenceError` says `imperative launch options have no non-secret durable
 * source`, and a checkpoint inherits that refusal rather than writing something that will not
 * reproduce the seat.
 */
export declare function assertSeatsCheckpointable(inventory: unknown): void;
/** Capture one checkpoint per retained seat, after the cut has proven the whole stack down. */
export declare function captureSeatCheckpoints(root: string, space: string, resume: MaintenanceResumeDescriptor, destination: string, sessionStores: readonly string[]): Promise<SeatCheckpoint[]>;
/** Wire-truth control-plane quiescence: a live manager/delivery daemon renews its lease
 *  continuously, so the cut publishes `ready` only once BOTH lease buckets hold no live value —
 *  a dead daemon's lease expires by TTL, a pidless live one keeps renewing and is refused here.
 *  Pidfiles are hints; leases are proof. */
export declare function assertControlPlaneQuiesced(space: string, server: string): Promise<void>;
/** Read current KV subjects by Direct Get so the cut check leaves no ephemeral/native consumer.
 *
 *  Exported for the gated tombstone cell. A regression test for the lease walk has to run through
 *  THIS function, not a transcription of it: a copy carries its own `allowEmpty` parameter, so it
 *  stays green when the argument at the real call site is removed and proves nothing about the fix. */
export declare function readPresenceWithoutConsumer(space: string, server: string): Promise<{
    roster: Presence[];
    managerId: string;
}>;
/**
 * Compatibility inventory for `clean`; lifecycle commands use the registered descriptors above.
 *
 * ABSOLUTE paths, and EVERY name each record has been written under. The runtime records are
 * `{space}` templates now, so only the local-process seam may expand one, and a sweeper that named
 * just the canonical spelling would leave a pre-upgrade `manager.pid` behind on exactly the root a
 * full reset is for. Built from the CANDIDATE list rather than {@link localProcessPath}: a deleter
 * must name what it removes, and the resolver refuses on a root holding both spellings.
 */
export declare function pidfileTargets(space: string, root: string): Array<[file: string, label: string]>;
/** `liveness` keeps `probeLiveness`'s three states so each caller picks its direction: a presence
 *  reader requires `"alive"`, a destructive guard proceeds only on `"dead"`. No record and an empty
 *  husk are `"dead"`; unattributable content and a removal reservation are `"unknown"`, because
 *  `cotal down` refuses them as possibly fronting a live process. */
export type PidfileState = {
    pid?: number;
    liveness: "alive" | "dead" | "unknown";
    note?: string;
};
/** Shared hardened pid probe: positive integers only, and EPERM means the process exists. */
export declare function pidfileState(path: string): PidfileState;
//# sourceMappingURL=down.d.ts.map