import { type ConsumerConfig, type ConsumerInfo } from "@nats-io/jetstream";
import { type NatsConnection } from "@nats-io/transport-node";
import { type BackupStreamState, type SpaceBackupSelection } from "./backup-config.js";
export declare class JetStreamBackupError extends Error {
    readonly code?: number | undefined;
    readonly errCode?: number | undefined;
    constructor(message: string, code?: number | undefined, errCode?: number | undefined);
}
export interface StreamSnapshotMetadata {
    config: Record<string, unknown>;
    state: BackupStreamState;
}
export interface DownloadStreamSnapshotOptions {
    deliverSubject: string;
    onChunk(chunk: Uint8Array): void | Promise<void>;
    timeoutMs?: number;
    /** Per-chunk sink deadline. Must stay below the server's two-second snapshot flow timeout. */
    sinkTimeoutMs?: number;
    checkMessages?: boolean;
}
/** Download a no-consumer native snapshot through one ordered, deadline-bounded sink. Each ackable
 * binary chunk is ACKed only after its sink call succeeds. Completion requires a clean empty EOF
 * after all accepted chunks. */
export declare function downloadStreamSnapshot(nc: NatsConnection, stream: string, opts: DownloadStreamSnapshotOptions): Promise<StreamSnapshotMetadata>;
export interface StreamRestoreSession {
    stream: string;
    deliverSubject: string;
}
/** Initiate restore with caller-supplied, current canonical config and separately validated state.
 * Snapshot-embedded config is never trusted or sent to the target broker. */
export declare function initiateStreamRestore(nc: NatsConnection, space: string, stream: string, config: Readonly<Record<string, unknown>>, state: Readonly<Record<string, unknown>>, timeoutMs?: number): Promise<StreamRestoreSession>;
/** Upload one non-empty binary restore chunk and await the server's storage ACK. */
export declare function uploadStreamRestoreChunk(nc: NatsConnection, session: StreamRestoreSession, chunk: Uint8Array, timeoutMs?: number): Promise<void>;
export interface StreamRestoreResult {
    config: Record<string, unknown>;
    state: BackupStreamState;
}
/** Send the empty EOF request and require the final stream-create response. */
export declare function finalizeStreamRestore(nc: NatsConnection, session: StreamRestoreSession, timeoutMs?: number): Promise<StreamRestoreResult>;
export interface PersistentConsumerCheckpoint {
    stream: string;
    name: string;
    ackFloorStreamSequence: number;
    creationLowerBound: number;
    streamState: Pick<BackupStreamState, "messages" | "first_seq" | "last_seq">;
}
/** Validate one recognized Cotal pull durable. Limits-retention consumers accept the checkpoint
 * migration shape; TASK remains canonical WorkQueue DeliverAll. */
export declare function validatePersistentConsumer(space: string, stream: string, info: ConsumerInfo): void;
/** Validate the complete consumer inventory for all eight streams and extract conservative checkpoints. */
export declare function validatePersistentConsumerInventory(space: string, consumersByStream: Readonly<Record<string, readonly ConsumerInfo[]>>, statesByStream: Readonly<Record<string, BackupStreamState>>): PersistentConsumerCheckpoint[];
/** Recreate a validated pull durable. Limits-retention consumers start after the contiguous ACK
 * floor and original lower bound; TASK uses WorkQueue DeliverAll because ACKed entries left the stream. */
export declare function consumerConfigFromCheckpoint(space: string, checkpoint: PersistentConsumerCheckpoint): Partial<ConsumerConfig>;
/** Recreate one validated checkpoint through the NATS 2.10 extended create API, whose subject pins
 * stream, durable name, and its canonical single filter. */
export declare function recreateConsumerCheckpoint(nc: NatsConnection, space: string, checkpoint: PersistentConsumerCheckpoint, timeoutMs?: number): Promise<ConsumerInfo>;
export type BackupPermissionScope = {
    operation: "snapshot";
    stream: string;
    deliverSubject: string;
} | {
    operation: "inspect";
    selection: SpaceBackupSelection;
};
export type RestorePermissionScope = {
    operation: "initiate";
    stream: string;
} | {
    operation: "upload";
    stream: string;
    deliverSubject: string;
} | {
    operation: "validate";
    stream: string;
} | {
    operation: "checkpoint";
    checkpoint: PersistentConsumerCheckpoint;
};
/** Exact snapshot permission set. It has no stream read/admin verbs beyond one snapshot API; chunk
 * ACK authority is created dynamically for the exact reply received, never granted as a wildcard. */
export declare function backupProfilePermissions(space: string, connId: string, scope: BackupPermissionScope): Record<string, unknown>;
/** Restore initiation, exact-ID upload, stream validation, and one-checkpoint recreation are disjoint
 * credentials. No phase inherits a body-read verb or another phase's mutation authority. */
export declare function restoreProfilePermissions(space: string, connId: string, scope: RestorePermissionScope): Record<string, unknown>;
//# sourceMappingURL=backup.d.ts.map