import type { LaunchctlRunner } from "./launchd.js";
import type { BackgroundLifecycleTarget, BackgroundLockAcquireOptions } from "./launchd-lifecycle-lock.js";
declare const OWNED_MAINTENANCE_LIFECYCLE: unique symbol;
export interface LaunchdMaintenanceLifecycleLease {
    readonly label: string;
    readonly pid: number;
    readonly [OWNED_MAINTENANCE_LIFECYCLE]: true;
}
export interface LaunchdMaintenanceGateDependencies {
    readonly runner: LaunchctlRunner;
    readonly getuid: () => number;
    readonly currentPid: () => number;
    readonly isAlive: (pid: number) => boolean;
    readonly acquireLifecycleLock: (target: BackgroundLifecycleTarget, options?: BackgroundLockAcquireOptions) => Promise<(() => Promise<void>) | undefined>;
    readonly stderr: (text: string) => void | Promise<void>;
}
export declare function defaultLaunchdMaintenanceGateDependencies(): LaunchdMaintenanceGateDependencies;
/**
 * Authenticate the exact launchd-owned helper, then own its per-agent lifecycle
 * lock nonblocking before invoking any caller-supplied inspection or import.
 * The account-wide log lock is deliberately acquired later, only around the
 * shared-chain mutation that actually needs it.
 */
export declare function withLaunchdMaintenanceControllerLock(target: BackgroundLifecycleTarget, deps: LaunchdMaintenanceGateDependencies, operation: (ownership: LaunchdMaintenanceLifecycleLease) => Promise<number>): Promise<number>;
/** Reject heavy reconciliation calls that did not cross this authenticated gate. */
export declare function assertLaunchdMaintenanceLifecycleLease(ownership: LaunchdMaintenanceLifecycleLease, target: BackgroundLifecycleTarget): void;
export {};
//# sourceMappingURL=launchd-maintenance-gate.d.ts.map