/**
 * The three named seed-state files plus the durable authority backup, and the monotonic contract
 * that keeps a deliberately-removed connector removed across a version bump.
 *
 * `ever-seeded` is the authority: the set of built-ins that were EVER seeded. It only grows. A name
 * in it but absent from the extensions manifest was removed on purpose (leave it removed); a name
 * NOT in it was never seeded (seed it). Losing this set would resurrect removals, so it is mirrored
 * into an append-only backup — the only thing `--repair` can recover from. Write order per reconcile:
 * authority (with its backup) first, then the witness, then the stamp LAST, so a stamp is never
 * current ahead of the authority it certifies.
 */
export interface Authority {
    /** Built-in connector names ever seeded on this machine. Monotonic — never shrinks. */
    readonly everSeeded: string[];
}
export interface Witness {
    readonly initialized: true;
    /** The generation that first initialized this prefix (diagnostic; the stamp tracks the latest). */
    readonly firstGeneration: string;
}
export interface Stamp {
    /** The generation the last completed reconcile ran for. */
    readonly generation: string;
    /** The exact CLI entry script that committed this generation. Absent on legacy stamps. */
    readonly writtenBy?: string;
    /** ISO-8601 commit time. Absent on legacy stamps. */
    readonly writtenAt?: string;
}
export declare function readAuthority(): Authority | undefined;
export declare function readAuthorityBackup(): Authority | undefined;
export declare function readWitness(): Witness | undefined;
export declare function readStamp(): Stamp | undefined;
/** The ever-seeded set unioned with its monotonic backup. A live authority that lost ids (a truncated
 *  or partially-corrupt write that still parsed) can only SHRINK the set; the backup is a superset, so
 *  unioning it on read means a deliberately-removed connector is never resurrected by such a loss.
 *  Returns undefined only when BOTH are absent (the genuinely-lost case the caller must fail loud on). */
export declare function everSeededUnion(): Set<string> | undefined;
/**
 * Persist the ever-seeded authority. The backup is updated FIRST as a monotonic UNION (old backup ∪
 * new set), so the recovery source is always a superset of the live authority and a crash between the
 * two writes can only lose ids from the authority (which the backup then restores), never from both.
 * An older binary that reads this must union unknown ids, never drop them.
 */
export declare function writeAuthority(everSeeded: Set<string>): void;
/** Write the initialization witness once (idempotent; refreshing it would erase the first-seen gen). */
export declare function ensureWitness(generation: string): void;
/** Write the version stamp LAST — the only thing that flips the fast path to "reconcile complete". */
export declare function writeStamp(generation: string, writtenBy: string): Stamp;
/** Recover a lost authority from the durable backup (for `--repair`). Undefined when even the backup
 *  is gone — the caller REFUSES, because a witness alone cannot tell a removed connector from a
 *  never-seeded future one. */
export declare function recoverAuthorityFromBackup(): Set<string> | undefined;
/** Move aside any seed-state file that no longer reads/validates, so a `--reset` can rebuild clean
 *  state instead of wedging when a commit helper re-reads the same corrupt file. Returns the
 *  quarantine paths (for reporting). `--reset` overwrites authority/backup/witness/stamp anyway; this
 *  just guarantees the pre-write reads (e.g. {@link ensureWitness}) can't throw on a corrupt one. */
export declare function quarantineCorruptSeedState(): string[];
//# sourceMappingURL=authority.d.ts.map