/** Resolved at-rest policy the journal + ledger writers consult. */
export interface AtRestPolicy {
    /** Redact secret/credential patterns in each record before it is written. */
    readonly redact: boolean;
    /** Retention caps enforced over the on-disk files. */
    readonly retention: {
        /** Delete files whose mtime is older than this many milliseconds. */
        readonly maxAgeMs: number;
        /** Delete oldest files until the set's total size is under this many bytes. */
        readonly maxTotalBytes: number;
    };
}
/**
 * The honest defaults, used when no config is wired: redaction ON, retention
 * generous but bounded (30 days / 512 MB) so a long-lived daemon cannot grow
 * these files without limit while a normal debugging window stays intact.
 */
export declare const DEFAULT_AT_REST_POLICY: AtRestPolicy;
/** Config keys backing the policy (see config/schema-domain-at-rest.ts). */
export declare const AT_REST_CONFIG_KEYS: {
    readonly redactEnabled: "atRest.redactionEnabled";
    readonly maxAgeDays: "atRest.retentionMaxAgeDays";
    readonly maxTotalMb: "atRest.retentionMaxTotalMb";
};
/**
 * Build a resolved policy from a config getter (ConfigManager.get shape). A
 * missing/invalid value falls back to the honest default rather than throwing,
 * a config problem must never take the write path down.
 */
export declare function resolveAtRestPolicy(get?: (key: string) => unknown): AtRestPolicy;
/**
 * Redact secret/credential patterns in a serialized JSON line. Reuses
 * redactCredentialsOnly so the credential pattern set stays a single source
 * shared with the telemetry egress, without also applying that egress helper's
 * home-path anonymisation to a file that never leaves this machine. The
 * replacements are JSON-safe markers, so the result stays a valid, parseable
 * line.
 */
export declare function redactAtRestLine(line: string): string;
export interface RetentionOutcome {
    readonly deletedFiles: readonly string[];
    readonly reclaimedBytes: number;
}
/**
 * Enforce the age + total-size caps over a set of append-only files, deleting
 * oldest-first. Missing files are skipped. Deletion failures are swallowed
 * (best-effort gc must never break the write path) but excluded from the
 * reclaimed total. Returns what was reclaimed for the caller to log.
 */
export declare function enforceFileRetention(files: readonly string[], policy: AtRestPolicy): RetentionOutcome;
/**
 * Enforce retention over every `*.jsonl` transcript-journal file in a directory
 * (the per-agent `<agentId>.jsonl` logs). A convenience wrapper over
 * enforceFileRetention that resolves the directory listing; a missing directory
 * is a no-op.
 */
export declare function enforceJournalDirectoryRetention(dir: string, policy: AtRestPolicy): RetentionOutcome;
//# sourceMappingURL=at-rest-persistence.d.ts.map