import type { DatabaseSync } from "node:sqlite";
/**
 * A write-mode open was attempted on a sealed (0444) data artifact.
 */
export declare class SealedArtifactError extends Error {
    constructor(path: string);
}
/**
 * True when the artifact exists and carries no write bits (the sealed state {@link sealDatabase} leaves).
 */
export declare function isSealed(path: string): boolean;
/**
 * Finalize a built DB: WAL-checkpoint → `journal_mode = DELETE` → remove `-wal`/`-shm` sidecars → `chmod 0o444`.
 * Idempotent. Throws if the checkpoint cannot complete (another writer holds the DB).
 */
export declare function sealDatabase(path: string): void;
/**
 * Verify a freshly-built database is not corrupt, immediately before it is sealed and published.
 *
 * Belongs beside {@link sealDatabase} for the same reason `swapDatabaseIntoPlace` does: the check is part of the
 * built-artifact lifecycle, and every builder was running it from its own copy. `integrity_check` answers with the
 * single row `{ integrity_check: "ok" }` on a healthy file and one row per problem otherwise, so only the first matters
 * — a builder that reads the column and compares it to `"ok"` has done the whole check.
 *
 * @throws When the database reports anything other than `ok`, naming the artifact and what SQLite said.
 */
export declare function assertDatabaseIntegrity(db: DatabaseSync, artifact: string): void;
/**
 * Open a data artifact. Read-only by default. `write: true` is for builders working on UNsealed staging — against a
 * sealed artifact it throws {@link SealedArtifactError}.
 */
export declare function openBuiltDatabase(path: string, opts?: {
    write?: boolean;
}): DatabaseSync;
/**
 * Atomically move a freshly-built database into its published location.
 *
 * The build writes to a temp path, so a mid-build crash never leaves a half-written DB at `finalPath`. This moves any
 * prior version aside, slots the new one in, then drops the old — the previous file stays intact until the replacement
 * is committed, and the `-wal`/`-shm` siblings of BOTH paths are cleared so a stale journal can never be paired with a
 * new main file.
 *
 * Sealing (`sealDatabase`) happens on the temp file BEFORE the swap: a sealed artifact is what gets published, and 0444
 * does not prevent a rename.
 */
export declare function swapDatabaseIntoPlace(tmpPath: string, finalPath: string): void;
//# sourceMappingURL=sealed-db.d.ts.map