import type { SessionPaths } from '../../session/paths.js';
import { SessionTokenBudget, type SessionTokenBudgetScope, type SessionTokenBudgetSnapshot } from './ledger.js';
/**
 * Durable storage for one token ledger per `(rootSessionId, rootTurnId)`.
 *
 * A root turn and every child session turn under it share one writer. Save
 * atomically replaces a complete record and refuses one that would lose
 * spend, a receipt or an account (a stale save); a missing record is null and
 * a corrupt or foreign one throws. Exclusive ownership across processes is
 * the session lease's job, not this store's.
 */
export interface SessionTokenBudgetStore {
    load(scope: SessionTokenBudgetScope): Promise<SessionTokenBudgetSnapshot | null>;
    save(scope: SessionTokenBudgetScope, snapshot: SessionTokenBudgetSnapshot): Promise<void>;
}
export interface DiskSessionTokenBudgetStoreOptions {
    /** The project whose root sessions hold the ledgers. */
    readonly paths: SessionPaths;
}
/**
 * {@link SessionTokenBudgetStore} at `<root-session-id>/budgets/<root-turn-id>.json`.
 *
 * The file is the snapshot itself (`kind: 'token-budget'`, `v: 2`). Writes
 * from this instance are serialised per ledger and go through a private
 * sidecar and a rename. New directories are mode 0700 and files 0600.
 */
export declare class DiskSessionTokenBudgetStore implements SessionTokenBudgetStore {
    #private;
    constructor(options: DiskSessionTokenBudgetStoreOptions);
    load(scope: SessionTokenBudgetScope): Promise<SessionTokenBudgetSnapshot | null>;
    save(scope: SessionTokenBudgetScope, snapshot: SessionTokenBudgetSnapshot): Promise<void>;
}
export interface OpenSessionTokenBudgetOptions {
    readonly store: SessionTokenBudgetStore;
    readonly scope: SessionTokenBudgetScope;
    /**
     * Required for a new ledger. Reopening an existing ledger with a
     * different limit is refused: a new limit belongs to a new root turn,
     * which opens a ledger of its own.
     */
    readonly limit?: number;
    /** Open this account of the ledger (a checkpoint's binding) instead of the root. */
    readonly accountId?: string;
    /** A checkpoint binding must never create a fresh ledger if its record is gone. */
    readonly requireExisting?: boolean;
}
/** Open the latest authority for a root turn; a checkpoint only selects an existing account. */
export declare function openSessionTokenBudget(options: OpenSessionTokenBudgetOptions): Promise<SessionTokenBudget>;
/** Validate both ids of a ledger key, so neither can reach a path or a map key unchecked. */
export declare function validateBudgetScope(scope: SessionTokenBudgetScope): SessionTokenBudgetScope;
/** @internal Validate a snapshot and check it is the ledger of `scope` (the owner check). */
export declare function validateSnapshotScope(snapshot: unknown, scope: SessionTokenBudgetScope): SessionTokenBudgetSnapshot;
/**
 * @internal Refuse a save that would replace the ledger with another root,
 * or lose an account, spend, a receipt or an unresolved request: a stale
 * writer's snapshot. Shared with the in-memory store so the two refuse alike.
 */
export declare function assertSameRoot(before: SessionTokenBudgetSnapshot, after: SessionTokenBudgetSnapshot): void;
//# sourceMappingURL=disk.d.ts.map