import type { FleetProcessEntry } from './fleet-shutdown.js';
/** Preserve PM2's raw stop_exit_codes elements for exact policy validation.
 * PM2 applies parseInt to string elements at exit time, so lossy numeric
 * projection would hide restart-suppressing extras such as "0foo". */
export declare function normalizeRawPm2StopExitCodes(value: unknown): unknown[];
/** Pure predicate: does this PM2 row prove signal-death autorestart? A daemon
 * is only safe to signal when PM2 will auto-restart it after a graceful exit,
 * i.e. autorestart=true AND stop_exit_codes is exactly the reserved sentinel.
 * `stop_exit_codes:[0]` would suppress restart after PM2 normalizes
 * SIGKILL/OOM to exit_code 0, so anything but the exact sentinel is unsafe. */
export declare function fleetEntryProvesSignalDeathAutorestart(entry: FleetProcessEntry): boolean;
/** Non-throwing sibling of assertDaemonPm2GracefulExitPolicy. Returns the
 * daemon rows that still run an old PM2 policy (missing the signal-death
 * autorestart proof). A non-empty result means a normal stop/restart will
 * fail closed and the operator must run the one-time
 * `--bootstrap-shutdown-protocol` upgrade. Read-only surfaces (e.g. the
 * dashboard update endpoint) use this to detect the boundary *before* firing
 * a detached restart that would otherwise die silently. */
export declare function daemonRowsMissingSignalDeathAutorestart(entries: FleetProcessEntry[]): FleetProcessEntry[];
/** The in-memory shutdown capability is insufficient when PM2 still owns an
 * old registry policy. In particular `stop_exit_codes:[0]` suppresses restart
 * after PM2 normalizes SIGKILL/OOM to exit_code 0. Require the exact daemon
 * policy that makes only shutdown()'s reserved sentinel terminal. */
export declare function assertDaemonPm2GracefulExitPolicy(operation: string, entries: FleetProcessEntry[]): void;
/** Require one exact, online, OS-live registry row for every configured core
 * process and no stale/foreign core rows. This is the postcondition for every
 * public fleet start surface. */
export declare function assertConfiguredPm2FleetOnline(operation: string, entries: FleetProcessEntry[], configuredNames: string[], isAlive: (pid: number) => boolean): void;
/** PM2 `online` is published before a daemon's shutdown endpoint/handler-ready
 * capability. A public start is complete only after both authorities agree. */
export declare function assertConfiguredPm2FleetReady<TEntry extends FleetProcessEntry>(operation: string, entries: TEntry[], configuredNames: string[], isAlive: (pid: number) => boolean, assertDaemonCapabilities: (entries: TEntry[]) => void): void;
/** Capability scanners used by shutdown may legitimately omit a target that
 * exited during their read. Start verification may not: require an exact
 * attested PID set and recheck OS liveness after the capability scan. */
export declare function assertExactAttestedDaemonSet(operation: string, daemonEntries: FleetProcessEntry[], attestedPids: readonly number[], isAlive: (pid: number) => boolean): void;
export type StartBotFleetAdmission = {
    state: 'already-online';
} | {
    state: 'start-eligible';
} | {
    state: 'fleet-down';
};
/** `start-bot` is safe only for the append-one-bot case: either the entire
 * configured fleet is already online, or exactly the requested bot row is
 * absent while every other configured bot and the dashboard are online. */
export declare function classifyStartBotFleetAdmission(operation: string, entries: FleetProcessEntry[], configuredNames: string[], targetName: string, isAlive: (pid: number) => boolean): StartBotFleetAdmission;
export interface Pm2StartTransactionRuntime<TProjection> {
    start(timeoutMs: number): void;
    /** Must obtain a new projection and validate the complete expected state. */
    verifyFresh(timeoutMs: number): TProjection;
    /** Must independently re-read authority before compensating partial launch. */
    rollback(): void;
}
/** Run one bounded PM2 launch and make the fresh fleet projection—not the CLI
 * exit code—the success authority. Any incomplete/unverified launch is
 * compensated before the error escapes. */
export declare function runBoundedPm2StartTransaction<TProjection>(operation: string, startTimeoutMs: number, verifyTimeoutMs: number, runtime: Pm2StartTransactionRuntime<TProjection>): TProjection;
export interface LatePm2StartRollbackRuntime {
    now(): number;
    sleep(ms: number): void;
    /** Re-read authority and compensate anything currently published. Return
     * true only when this observation exactly matches the pre-start state. */
    reconcileOnce(): boolean;
}
/** A killed/timed-out PM2 client does not cancel work already queued in God.
 * Therefore an empty first rollback projection is not success: require one
 * continuous restored window, resetting it whenever a late row appears. */
export declare function reconcileLatePm2StartPublication(operation: string, settleMs: number, timeoutMs: number, runtime: LatePm2StartRollbackRuntime): void;
//# sourceMappingURL=pm2-start-transaction.d.ts.map