import { type ControllerCutBinding, type ControllerStop, type JsonValue, type MaintenanceLock, type MaintenanceReadyRecord, type RollbackRestoreOptions } from "@cotal-ai/workspace";
import { type ServiceDefinitionSnapshot } from "./service-definitions.js";
type BrokerOptions = {
    readonly config: string;
    readonly [key: string]: JsonValue;
};
/** Broker coupling for backup and restore: the live broker definition is the revision
 *  the cut expects, and the configuration it names hashes to the cut launch's recorded digest. */
export declare function assertControllerBrokerConfig(space: string, cut: ControllerCutBinding): {
    definition: ServiceDefinitionSnapshot;
    options: BrokerOptions;
    configSha256: string;
};
/** Preflight for `backup restore` and `up --restore` on a controller cut, before
 *  staging, a claim or any store move: the cut is coupled and eligible, its broker configuration is
 *  the cut launch's, and an alternate target needs one exact JetStream block to rewrite. */
export declare function assertControllerRestorable(root: string, journal: MaintenanceReadyRecord, cut: ControllerCutBinding, storeDir: string | undefined): void;
/** Rewrite the broker definition before commit intent and under the maintenance lock. The rendered
 *  configuration is written create-only and journaled with its inode as `rendered` before the
 *  definition write; `definition-committed` follows the write. A crash between the file and its
 *  record leaves an unreferenced file named for the attempt. */
export declare function reconfigureControllerBroker(lock: MaintenanceLock): void;
/** Pre-commit rollback for every restore. A controller alternate restore first returns its broker
 *  definition to the source configuration, as a new revision that the cut then expects, and only
 *  then rolls the store back. The live claim is checked before any definition write. Any revision
 *  the journal cannot attribute holds and nothing is overwritten.
 *
 *  The rebound revision is never written into the cut's retired broker record. The next resume or
 *  restore starts a new broker instance at that revision, journaled first, and removes the retired
 *  record once the attempt is active. */
export declare function rollbackRestoreWithBroker(lock: MaintenanceLock, options?: RollbackRestoreOptions): MaintenanceReadyRecord;
/** Once the attempt's new broker runs, remove only the
 *  cut's retired broker record, under the definition writer lock and by a CAS on the snapshot read
 *  there. It must still be the stopped cut launch with its own kernel-exit receipt equal to the
 *  journal row, gone, with no supervisor or native unit attempt. Absence is a completed removal. */
export declare function removeRetiredBrokerInstance(space: string, cut: ControllerCutBinding, stops: readonly ControllerStop[]): void;
export {};
//# sourceMappingURL=controller-restore.d.ts.map