import { z } from 'zod';
/**
 * Read-only introspection of a scope's own database — the console/dashboard "Data"
 * view (kernel-design §5.4's admin-query RPC, cashed in as two narrow primitives).
 *
 * This is an OPERATOR read, not module code and not an operation: it reaches a
 * scope's SQLite directly through `HostAdmin`, so it takes a `PlatformActorId` and
 * records to the staff access log (K-24) like every other directory read. It is
 * deliberately *read-only and table-shaped* — there is no user-supplied SQL, only a
 * table name validated against the live schema plus a bounded page — so there is no
 * write path to forge the spine and no injection surface to guard.
 */
/**
 * One table in a scope's database. `system` marks the platform's own spine tables
 * (`_substrat_*`) and SQLite internals (`sqlite_*`) so the UI can group them apart
 * from the vertical's own data — reads of them are allowed (projections read the
 * spine); it is only writes the module rules forbid.
 */
export declare const scopeTable: z.ZodObject<{
    name: z.ZodString;
    rowCount: z.ZodNumber;
    system: z.ZodBoolean;
}, z.core.$strip>;
export type ScopeTable = z.infer<typeof scopeTable>;
/**
 * A bounded page of rows from one table. `columns` is the column order; each row in
 * `rows` is a positional array aligned to it (JSON values — SQLite text/int/real/
 * null/blob-as-null). `rowCount` is the table's TOTAL row count, so the UI can page.
 */
export declare const scopeTablePage: z.ZodObject<{
    table: z.ZodString;
    columns: z.ZodArray<z.ZodString>;
    rows: z.ZodArray<z.ZodArray<z.ZodUnknown>>;
    rowCount: z.ZodNumber;
    limit: z.ZodNumber;
    offset: z.ZodNumber;
}, z.core.$strip>;
export type ScopeTablePage = z.infer<typeof scopeTablePage>;
export declare const SCOPE_TABLE_PAGE_DEFAULT = 50;
export declare const SCOPE_TABLE_PAGE_MAX = 200;
/**
 * What `readScopeTable` accepts. `table` is validated against the live schema by the
 * adapter (an unknown name is rejected, never interpolated). `limit` is clamped to
 * [1, SCOPE_TABLE_PAGE_MAX]; `offset` is a non-negative row offset for paging.
 */
export declare const readScopeTableInput: z.ZodObject<{
    table: z.ZodString;
    limit: z.ZodDefault<z.ZodNumber>;
    offset: z.ZodDefault<z.ZodNumber>;
}, z.core.$strip>;
export type ReadScopeTableInput = z.infer<typeof readScopeTableInput>;
/**
 * One record's history (#1235): the entity whose story to read, and where to
 * continue. Cursor-paged rather than offset-paged, unlike the table read above —
 * `readHistory` pages by the outbox id, so a new event arriving mid-walk cannot
 * shift a page boundary and duplicate or skip an entry.
 */
export declare const entityHistoryInput: z.ZodObject<{
    entityType: z.ZodString;
    entityId: z.ZodString;
    limit: z.ZodOptional<z.ZodNumber>;
    cursor: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
export type EntityHistoryInput = z.infer<typeof entityHistoryInput>;
/** Which event to walk back from (#1237), and how far to follow the trail. */
export declare const eventCauseInput: z.ZodObject<{
    eventId: z.core.$ZodBranded<z.ZodString, "EventId", "out">;
    maxDepth: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>;
export type EventCauseInput = z.infer<typeof eventCauseInput>;
/** Which event to expand forward (#1237), and how much of the tree to build. */
export declare const eventEffectsInput: z.ZodObject<{
    eventId: z.core.$ZodBranded<z.ZodString, "EventId", "out">;
    maxNodes: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>;
export type EventEffectsInput = z.infer<typeof eventEffectsInput>;
/**
 * Which call to read whole (#1237), and how many of its events.
 *
 * The id is the one `invocationLog` mints and writes on the call's log line, so a string
 * rather than a ULID schema: the transport carries it through `InvokeOptions` and the
 * read's job is to match it, not to judge it. Bounded so a crafted id stays a lookup.
 */
export declare const invocationEventsInput: z.ZodObject<{
    invocationId: z.ZodString;
    limit: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>;
export type InvocationEventsInput = z.infer<typeof invocationEventsInput>;
/**
 * One page of a scope's dead-lettered deliveries (#1525), newest event first.
 *
 * The cursor is the last entry's `eventId|consumer` — the pair the walk orders by, since
 * one event can give up on several consumers — and is exclusive, like every list read.
 */
export declare const deadLettersInput: z.ZodObject<{
    limit: z.ZodOptional<z.ZodNumber>;
    cursor: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
export type DeadLettersInput = z.infer<typeof deadLettersInput>;
/**
 * What to group an event facet by (#1239 stage 1). Either an envelope column —
 * facts the kernel stamps and can never be erased — or one field of the fat
 * payload, which CAN be erased and is therefore counted differently (see
 * `eventFacetResult.erased`).
 *
 * A payload field is a single name, validated rather than interpolated: it
 * reaches SQLite as a bound JSON path, so the pattern here is what keeps the
 * query shape fixed. Nested paths are a deliberate v1 omission, not an oversight
 * — one level answers "which currency", and deeper paths want their own thought
 * about arrays.
 */
export declare const eventFacetGroupBy: z.ZodUnion<readonly [z.ZodObject<{
    kind: z.ZodEnum<{
        actor: "actor";
        entityType: "entityType";
        invocation: "invocation";
        operation: "operation";
        piiClass: "piiClass";
        type: "type";
        version: "version";
    }>;
}, z.core.$strip>, z.ZodObject<{
    kind: z.ZodLiteral<"payload">;
    field: z.ZodString;
}, z.core.$strip>]>;
export type EventFacetGroupBy = z.infer<typeof eventFacetGroupBy>;
/** The outbox slice to facet (#1239). Narrow first, then group. */
export declare const eventFacetInput: z.ZodObject<{
    groupBy: z.ZodUnion<readonly [z.ZodObject<{
        kind: z.ZodEnum<{
            actor: "actor";
            entityType: "entityType";
            invocation: "invocation";
            operation: "operation";
            piiClass: "piiClass";
            type: "type";
            version: "version";
        }>;
    }, z.core.$strip>, z.ZodObject<{
        kind: z.ZodLiteral<"payload">;
        field: z.ZodString;
    }, z.core.$strip>]>;
    type: z.ZodOptional<z.ZodString>;
    since: z.ZodOptional<z.ZodString>;
    until: z.ZodOptional<z.ZodString>;
    limit: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>;
export type EventFacetInput = z.infer<typeof eventFacetInput>;
/** One grouped value and how many events carried it. */
export declare const eventFacetBucket: z.ZodObject<{
    value: z.ZodNullable<z.ZodString>;
    count: z.ZodNumber;
    lastSeen: z.ZodNullable<z.ZodString>;
}, z.core.$strip>;
export type EventFacetBucket = z.infer<typeof eventFacetBucket>;
export declare const eventFacetResult: z.ZodObject<{
    buckets: z.ZodArray<z.ZodObject<{
        value: z.ZodNullable<z.ZodString>;
        count: z.ZodNumber;
        lastSeen: z.ZodNullable<z.ZodString>;
    }, z.core.$strip>>;
    erased: z.ZodNumber;
    total: z.ZodNumber;
    truncated: z.ZodBoolean;
}, z.core.$strip>;
export type EventFacetResult = z.infer<typeof eventFacetResult>;
export declare const SCOPE_QUERY_ROW_MAX = 200;
/**
 * What `queryScope` accepts: one read-only SQL statement (#219). Unlike
 * `readScopeTable` this IS user-supplied SQL, so the safety moves from "no SQL at
 * all" to statement-level enforcement — the kernel's `assertReadOnlyQuery` textual
 * gate plus each adapter's authoritative check (better-sqlite3's
 * `prepare().readonly`; a rolled-back transaction on the DO). Editing rows stays
 * out of scope forever: a write here would forge the spine.
 */
export declare const queryScopeInput: z.ZodObject<{
    sql: z.ZodString;
}, z.core.$strip>;
export type QueryScopeInput = z.infer<typeof queryScopeInput>;
/**
 * A bounded result of one read-only query. Positional rows aligned to `columns`
 * (JSON values, blob-as-null, like a table page); `truncated` is set when the
 * statement had more rows than SCOPE_QUERY_ROW_MAX — the cap is a ceiling, never
 * an error, so an over-broad SELECT still shows its first screenful.
 */
export declare const scopeQueryResult: z.ZodObject<{
    columns: z.ZodArray<z.ZodString>;
    rows: z.ZodArray<z.ZodArray<z.ZodUnknown>>;
    truncated: z.ZodBoolean;
}, z.core.$strip>;
export type ScopeQueryResult = z.infer<typeof scopeQueryResult>;
/**
 * A COMPLETE, byte-faithful dump of one scope's database — the deliberate opposite
 * of `readScopeTable` above (bounded, blob-as-null, "not a dump"). This is the whole
 * scope: every table, its DDL, and every row, so it can rebuild the scope elsewhere.
 *
 * It is the privileged primitive the preview/snapshot machinery is built on
 * (docs/architecture/preview-and-snapshots.md §3) — the source a fork or a local pull
 * reads. It KEEPS the `_substrat_*` spine (a fork must carry the event/migration
 * state) and drops only SQLite's own `sqlite_*` internals (auto-managed, and
 * `CREATE TABLE sqlite_*` is rejected on reload). Because it exfiltrates a whole
 * scope, it is staff/audited like every `HostAdmin` read, never a UI affordance.
 */
export declare const scopeDumpTable: z.ZodObject<{
    name: z.ZodString;
    ddl: z.ZodString;
    columns: z.ZodArray<z.ZodString>;
    rows: z.ZodArray<z.ZodArray<z.ZodUnknown>>;
}, z.core.$strip>;
export type ScopeDumpTable = z.infer<typeof scopeDumpTable>;
export declare const scopeDump: z.ZodObject<{
    tenantId: z.ZodString;
    scopeId: z.ZodString;
    capturedAt: z.ZodString;
    tables: z.ZodArray<z.ZodObject<{
        name: z.ZodString;
        ddl: z.ZodString;
        columns: z.ZodArray<z.ZodString>;
        rows: z.ZodArray<z.ZodArray<z.ZodUnknown>>;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type ScopeDump = z.infer<typeof scopeDump>;
/**
 * One stored scope BACKUP, as the list/reap surfaces report it (#493) — metadata about a
 * `scopeDump` the platform holds, never the dump itself, so listing a scope's copies is
 * cheap and hands out no bytes.
 *
 * A backup is what makes the terminal reap survivable: reaping wipes a scope's Durable
 * Object storage irreversibly, so the control plane stores a full-fidelity dump first and
 * records this shape's address on the admin-log entry. Deliberately NOT a snapshot fork —
 * a fork lives inside the vertical's own deployment, so it neither survives that
 * vertical's retirement nor stops counting as a live scope against it.
 *
 * Addressed by (tenantId, scopeId, capturedAt): the store's own key scheme stays private
 * to the store, so no caller builds a path into another tenant's copies.
 */
export declare const scopeBackup: z.ZodObject<{
    tenantId: z.ZodString;
    scopeId: z.ZodString;
    vertical: z.ZodNullable<z.ZodString>;
    capturedAt: z.ZodString;
    size: z.ZodNumber;
    tables: z.ZodNumber;
}, z.core.$strip>;
export type ScopeBackup = z.infer<typeof scopeBackup>;
/**
 * A COMPLETE dump of the DIRECTORY — the platform's own database (#40), not a tenant's.
 *
 * The same table shape as a `scopeDump`, and deliberately so: both are the logical
 * row-dump of one SQLite database, so one reader, one writer, one wire shape. What
 * differs is what is inside and what losing it costs. A scope database holds one
 * customer's data and is protected by ~30-day DO point-in-time recovery; the directory
 * holds tenants, scopes, hostnames, verticals, identities and the admin log — the
 * mapping that makes every OTHER database addressable — and is unreconstructable from
 * them. `control-plane.md` puts it plainly: losing it is losing the platform, not
 * losing a cache.
 *
 * There is no (tenantId, scopeId) here because there is exactly ONE directory per
 * deployment. `capturedAt` is therefore the whole address of a copy.
 *
 * PITR already covers corruption INSIDE the account, which is why this exists on a
 * different axis: an off-DO copy is what survives a control-plane bug that deletes the
 * Durable Object outright. It does NOT survive loss of the Cloudflare account itself
 * while the store lives in that same account — see the honest scoping in
 * control-plane.md §4.9.
 */
export declare const directoryDump: z.ZodObject<{
    capturedAt: z.ZodString;
    tables: z.ZodArray<z.ZodObject<{
        name: z.ZodString;
        ddl: z.ZodString;
        columns: z.ZodArray<z.ZodString>;
        rows: z.ZodArray<z.ZodArray<z.ZodUnknown>>;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type DirectoryDump = z.infer<typeof directoryDump>;
/**
 * One stored DIRECTORY backup, as the list surface reports it (#40) — metadata about a
 * `directoryDump` the platform holds, never the dump itself. The scope-level analogue is
 * `scopeBackup`; this one carries no tenant or scope because the directory is the thing
 * that knows about tenants and scopes.
 */
export declare const directoryBackup: z.ZodObject<{
    capturedAt: z.ZodString;
    size: z.ZodNumber;
    tables: z.ZodNumber;
}, z.core.$strip>;
export type DirectoryBackup = z.infer<typeof directoryBackup>;
/**
 * Throw naming the offending identifier, or return it.
 *
 * Exported because a caller that reads names one at a time — walking `sqlite_master`
 * in a file it was handed, say — has to check each one at the point it interpolates
 * it, not as a batch afterwards.
 */
export declare function assertSqlIdentifier(name: string, what: string): string;
/** Every table and column name in a dump, checked before any of them reaches SQL. */
export declare function assertDumpIdentifiers(tables: {
    name: string;
    columns?: string[];
}[]): void;
/**
 * A dumped table's schema is exactly one `CREATE TABLE` for the name the dump
 * declared — checked BEFORE it runs, because a check that runs afterwards has
 * already let the statement happen.
 *
 * Both halves are load-bearing, and the second is the one that is easy to miss.
 * Executing a table's `ddl` runs EVERY statement the text contains — `db.exec` on
 * better-sqlite3 and `SqlStorage.exec` on a Durable Object both do — so
 * `CREATE TABLE x (id TEXT); ATTACH DATABASE '/tmp/out' AS e;` executed both halves
 * with two entirely plain identifiers, and nothing an identifier check adds would
 * have caught it. Pinning the head alone is not enough either: a trailing statement
 * rides in behind a perfectly honest `CREATE TABLE`.
 *
 * Refusing beats relying on the driver to compile only the first statement. That is
 * true of better-sqlite3's `prepare` and NOT true of a Durable Object, which has no
 * prepare step at all — so a rule that leaned on it would hold in the CLI and quietly
 * fail on the hosted path, which is the one that matters most.
 */
export declare function assertSingleCreateTable(ddl: string, name: string): void;
/**
 * Everything a dump must satisfy before any of it reaches SQL: its identifiers, and
 * one `CREATE TABLE` per table. The single entry point a replay site calls, so a new
 * one cannot pick up half the rules.
 */
export declare function assertReplayableDump(tables: {
    name: string;
    ddl: string;
    columns?: string[];
}[]): void;
//# sourceMappingURL=introspection.d.ts.map