import { type BigIntStats } from "node:fs";
type Awaitable<T> = T | Promise<T>;
type ClaimValidationPhase = "current" | "claimed" | "pre-publish" | "published";
type RecoveryMode = "preserve-current" | "restore-previous";
export interface VerifiedFileSnapshot {
    readonly contents: Buffer;
    readonly details: BigIntStats;
}
export interface VerifiedFileReadOptions {
    readonly validate: (details: BigIntStats, path: string) => void;
    readonly changedError: (path: string) => Error;
}
interface SecureReplaceFailure {
    readonly cause: unknown;
    readonly recoveryPaths: readonly string[];
}
type ExpectedTarget = {
    readonly kind: "missing";
} | {
    readonly kind: "present";
    readonly claimPath?: string;
    readonly validate: (path: string, moved: boolean) => Awaitable<boolean>;
    readonly invalidError: () => Error;
    readonly mismatchRecovery?: (phase: ClaimValidationPhase) => RecoveryMode;
};
interface TargetPublicationOptions {
    readonly expected: ExpectedTarget;
    readonly recovery: RecoveryMode;
    readonly failedPath?: string;
    readonly beforeClaim?: (targetPath: string, temporaryPath: string) => Awaitable<void>;
    readonly beforePublish?: (targetPath: string, temporaryPath: string) => Awaitable<void>;
    readonly afterPublish?: (targetPath: string, temporaryPath: string) => Awaitable<void>;
    readonly beforeRestore?: (targetPath: string, claimPath: string) => Awaitable<void>;
    readonly protectRecovery?: (path: string) => Awaitable<void>;
    readonly makeError?: (failure: SecureReplaceFailure) => Error;
}
interface SecureFileReplaceOptions {
    readonly path: string;
    readonly contents: string | Buffer;
    readonly mode: number;
    readonly temporaryPath?: string;
    readonly validateTemporary?: (details: BigIntStats, path: string) => void;
    readonly beforeCommit?: (temporaryPath: string) => Awaitable<void>;
    readonly syncDirectory?: (path: string) => Awaitable<void>;
    readonly target: TargetPublicationOptions;
}
/** Read one pathname through a nonblocking descriptor and prove its final identity. */
export declare function readVerifiedFile(path: string, options: VerifiedFileReadOptions): Promise<VerifiedFileSnapshot | undefined>;
/** Stage, compare-and-swap, recover, and final-prove one owner-private file. */
export declare function secureFileReplace(options: SecureFileReplaceOptions): Promise<void>;
export {};
//# sourceMappingURL=secure-file-replace.d.ts.map