import { type NatsConnection } from "@nats-io/transport-node";
import { type BackupPermissionScope, type RestorePermissionScope, type SpaceAuth } from "@cotal-ai/core";
import type { MaintenanceAuthMode, ProcessOwner } from "@cotal-ai/workspace";
export interface PrivateAttemptsDirectory {
    path: string;
    identity: {
        dev: bigint;
        ino: bigint;
    };
}
export declare function ensurePrivateAttemptsDir(root: string): PrivateAttemptsDirectory;
/** With the maintenance journal at `ready` and no live claim, nothing may legitimately live in the
 *  private attempts directory: every entry is residue of a dead attempt (staging, clones, broker
 *  run files) and is removed before new maintenance work begins. Strict — a failed removal aborts
 *  the caller rather than proceeding over unowned residue. */
export declare function sweepAttemptResidue(root: string): void;
/** Whether every isolated broker and watchdog started under `root` is proven gone. Each start
 *  creates its handshake file before it spawns the watchdog, and the watchdog writes both pids into
 *  it, so this covers a process the attempt started but never recorded in its claim. A handshake the
 *  watchdog never completed, or a pid that is not proven gone (ESRCH), is not proof. */
export declare function attemptProcessesGone(root: string): boolean;
export interface AttemptDirectory {
    path: string;
    identity: {
        dev: bigint;
        ino: bigint;
    };
    cleanup(): void;
}
export declare function createAttemptClone(root: string, sourceStore: string, attemptId: string): AttemptDirectory;
export interface IsolatedRunFile {
    path: string;
    dev: string;
    ino: string;
}
export interface IsolatedBroker {
    server: string;
    initialLogin: IsolatedMaintenanceLogin;
    brokerOwner: ProcessOwner;
    watchdogOwner: ProcessOwner;
    /** Attempt-owned run files (config, broker log, pid handshake) for claim journaling. */
    runFiles: readonly IsolatedRunFile[];
    addLogin(scope: IsolatedMaintenanceScope | ((connId: string) => IsolatedMaintenanceScope)): Promise<IsolatedMaintenanceLogin>;
    stop(): Promise<void>;
}
export type IsolatedMaintenanceScope = {
    profile: "backup";
    scope: BackupPermissionScope;
} | {
    profile: "restore";
    scope: RestorePermissionScope;
} | {
    profile: "infrastructure";
    streams: readonly string[];
    updateStreams?: readonly string[];
};
export interface IsolatedMaintenanceLogin {
    readonly user: string;
    readonly pass: string;
    readonly connId: string;
    readonly scope: IsolatedMaintenanceScope;
}
export declare function connectIsolatedBroker(broker: Pick<IsolatedBroker, "server">, login: IsolatedMaintenanceLogin): Promise<NatsConnection>;
export declare function infrastructureMaintenancePermissions(connId: string, streamNames: readonly string[], updateNames?: readonly string[]): Record<string, unknown>;
export declare function startIsolatedBroker(options: {
    root: string;
    storeDir: string;
    space: string;
    mode: MaintenanceAuthMode;
    auth?: SpaceAuth;
    deadline: Date;
    label: "backup" | "restore" | "quarantine";
    initialScope: IsolatedMaintenanceScope;
    /** Attempt id prefixing the run files, tying them to the journaled maintenance attempt. */
    attemptId?: string;
}): Promise<IsolatedBroker>;
//# sourceMappingURL=isolated-broker.d.ts.map