import { StoreCompression, type StreamConfig } from "@nats-io/jetstream";
export type SpaceBackupSelection = "full" | "registry";
export type SpaceBackupStreamClass = "messages" | "registry" | "authorization";
/** Why a stream is outside the backup artifact. `artifact` is its own class deliberately: object
 *  bytes are neither transient (they outlive a session), derived (nothing can recompute them),
 *  nor a lease. Excluding them is a RETENTION decision — pin extends lifetime, not durability —
 *  and giving it an honest name keeps a later reader from reading it as "derived, so recoverable".*/
export type SpaceBackupExcludedClass = "transient" | "derived" | "lease" | "control" | "artifact";
export interface SpaceBackupStream {
    name: string;
    class: SpaceBackupStreamClass;
}
export interface SpaceBackupExcludedStream {
    name: string;
    class: SpaceBackupExcludedClass;
}
export interface SpaceBackupInventory {
    backedUp: readonly SpaceBackupStream[];
    excluded: readonly SpaceBackupExcludedStream[];
    full: readonly string[];
    registry: readonly string[];
}
/** The complete Cotal stream inventory at a stable backup cut. Only the eight `backedUp` streams
 * enter a full artifact; excluded streams are transient, derived, leases, nonportable control state,
 * or the artifact object store. EVERY stream a space owns must appear in one list or the other:
 * {@link validateSpaceBackupInventory} is exact set-equality, so an unenumerated stream fails
 * validation for the WHOLE space, and a missing one fails it the same way. */
export declare function spaceBackupInventory(space: string): SpaceBackupInventory;
/** Reject a missing, foreign, or additional stream before selecting artifact components. */
export declare function validateSpaceBackupInventory(space: string, actualNames: readonly string[]): SpaceBackupInventory;
export interface BackupStreamState {
    messages: number;
    bytes: number;
    first_seq: number;
    last_seq: number;
    consumer_count: number;
    first_ts?: string;
    last_ts?: string;
    deleted?: number[];
    num_deleted?: number;
    num_subjects?: number;
    subjects?: Record<string, number>;
    lost?: {
        msgs?: number[] | null;
        bytes?: number;
    };
}
/** The NATS 2.10 stream-config surface Cotal permits in an artifact or restore request. */
export type CanonicalBackupStreamConfig = Pick<StreamConfig, "name" | "subjects" | "retention" | "storage" | "max_consumers" | "max_msgs" | "max_bytes" | "max_age" | "max_msgs_per_subject" | "max_msg_size" | "discard" | "num_replicas" | "duplicate_window" | "allow_direct" | "mirror_direct" | "discard_new_per_subject" | "allow_rollup_hdrs" | "deny_delete" | "deny_purge" | "sealed" | "consumer_limits"> & {
    no_ack: boolean;
    compression: typeof StoreCompression.None;
};
export declare const BACKUP_MAX_MSGS_PER_SUBJECT = 1000;
export declare const BACKUP_PLANE3_DEDUP_WINDOW_MS: number;
/** Current canonical config for one of the eight backed-up streams. Restore callers must use this
 * config, not the config embedded in untrusted snapshot bytes. */
export declare function canonicalBackupStreamConfig(space: string, stream: string): CanonicalBackupStreamConfig;
/** Validate every active and security-sensitive stream setting, including explicit rejection of
 * mirrors, sources, transforms, republish, placement, sealing, metadata, and future active features. */
export declare function validateCanonicalBackupStreamConfig(space: string, stream: string, actual: Readonly<Record<string, unknown>>): CanonicalBackupStreamConfig;
export declare function validateBackupStreamState(state: Readonly<Record<string, unknown>>): BackupStreamState;
//# sourceMappingURL=backup-config.d.ts.map