import { DshRemoteError } from './errors.js';
import type { DshRemoteOperation } from './types.js';
export type DshRemoteLedgerState = 'pending' | 'completed' | 'outcome_unknown';
export interface DshRemoteLedgerIdentity {
    accountId: string;
    runtimeRef: string;
    requestRef: string;
    operation: DshRemoteOperation;
    arguments: Record<string, unknown>;
    executeBeforeMillis: number;
}
export interface DshRemoteLedgerEntry extends Omit<DshRemoteLedgerIdentity, 'arguments'> {
    argumentsHash: string;
    state: DshRemoteLedgerState;
    dshRpcId: string;
    payload: Record<string, unknown>;
    createdAtMillis: number;
    updatedAtMillis: number;
}
/** Cross-client identity: mobile writes it before send and DSH echoes it in canonical history. */
export declare function dshRemoteCommandRpcId(input: Pick<DshRemoteLedgerIdentity, 'accountId' | 'runtimeRef' | 'requestRef'>): string;
export declare class DshRemoteCommandLedger {
    private readonly path;
    private readonly database;
    private readonly key;
    private readonly now;
    constructor(directory: string, key: Uint8Array, options?: {
        now?: () => number;
    });
    begin(input: DshRemoteLedgerIdentity): {
        duplicate: boolean;
        entry: DshRemoteLedgerEntry;
    };
    complete(identity: Pick<DshRemoteLedgerIdentity, 'accountId' | 'runtimeRef' | 'requestRef'>, result: Record<string, unknown>): DshRemoteLedgerEntry;
    completeRejected(identity: Pick<DshRemoteLedgerIdentity, 'accountId' | 'runtimeRef' | 'requestRef'>, error: Pick<DshRemoteError, 'code' | 'message' | 'retryable'>): DshRemoteLedgerEntry;
    markOutcomeUnknown(identity: Pick<DshRemoteLedgerIdentity, 'accountId' | 'runtimeRef' | 'requestRef'>, reason: string): DshRemoteLedgerEntry;
    get(identity: Pick<DshRemoteLedgerIdentity, 'accountId' | 'runtimeRef' | 'requestRef'>): DshRemoteLedgerEntry | undefined;
    pending(accountId: string, nowMillis?: number): DshRemoteLedgerEntry[];
    /**
     * Returns every unsettled command still inside the v4 reconciliation window.
     *
     * An expired execute_before only prevents executing the command again. It must
     * not hide the crash window where DSH accepted the stable rpcId before the Host
     * persisted the result. Callers must inspect DSH history and either complete
     * the entry or mark outcome_unknown; they must never re-dispatch these rows.
     */
    unsettledForReconciliation(accountId: string, nowMillis?: number, reconciliationWindowMillis?: number): DshRemoteLedgerEntry[];
    cleanup(options?: {
        retentionMillis?: number;
        maxCommands?: number;
    }): number;
    get isOpen(): boolean;
    close(): void;
    private validateIdentity;
    private identity;
    private requireIdentity;
    private entry;
    private appendEvent;
    private eventAad;
    private transaction;
    private secureFiles;
}
//# sourceMappingURL=command-ledger.d.ts.map