export interface AuthOptions {
    sub: string | undefined;
    /** second positional — the git-credential action */
    action?: string;
    host?: string;
    noBrowser?: boolean;
    stdin?: NodeJS.ReadStream;
}
export declare function cmdAuth(opts: AuthOptions): Promise<number>;
export interface RowsOptions {
    sub: string | undefined;
    /** `org/kb`, or bare `kb` (the stored org fills the other half) */
    kb?: string;
    document?: string;
    block?: string;
    host?: string;
    json?: boolean;
    /** patch: the uuid an update addresses */
    update?: string;
    /** patch: append a new record instead */
    append?: boolean;
    /** patch: `k=v` pairs, repeatable — the columns being written */
    fields?: string[];
    /** patch: explicit stamp, overriding the recorded read */
    readAt?: string;
    /** patch: send NO stamp — the explicit opt-out of the revision guard */
    unguarded?: boolean;
    /** patch: the kb_record format name; empty means the primary format */
    formatName?: string;
    /** where the working-layer mirror lives — resolveStamp's last rung reads
     *  the `.records.local.yaml` beside the document (default: .) */
    vault?: string;
}
export declare function cmdRows(opts: RowsOptions): Promise<number>;
/** `k=v` pairs → the record/sets object. Split at the FIRST `=`: values may
 *  carry their own. A pair with no `=`, or an empty key, is the caller's
 *  mistake and is named — a dropped field would be a write answering a
 *  different question from the one it was asked. */
export declare function parseFields(pairs: string[]): {
    fields: Record<string, string>;
    bad: string | null;
};
/**
 * The stamp a patch sends, and where it came from (L27's ladder, in order):
 *   --read-at <stamp>  explicit, wins;
 *   --unguarded        none, by name;
 *   reads.json         the stamp `dj rows get` recorded for this exact
 *                      host+kb+document+block;
 *   the mirror header  the `# dj:pull` header of the document's
 *                      `.records.local.yaml` — a pull IS a read of the
 *                      working layer, and refusing a patch on a freshly
 *                      pulled clone would send the caller to `dj rows get`
 *                      for a stamp the file on disk already carries;
 *   otherwise          REFUSED locally: a guarded write is the default, and
 *                      "read first" is the fix, not a convention.
 */
export declare function resolveStamp(opts: {
    readAt?: string;
    unguarded?: boolean;
}, recorded: string | null, mirror?: string | null): {
    readAt?: string;
} | {
    refusal: string;
};
/**
 * The mirror header's stamp for one block, or null — resolveStamp's LAST rung
 * (L27). Null covers every miss: no mirror file, no parseable header, no
 * stamp for this block — and, deliberately, a header from ANOTHER host or KB:
 * the header names where its stamps were read, and a stamp from a different
 * working layer guards nothing about this one (comparing it would let a
 * clone of KB A disarm the revision guard of KB B). Reading fails soft the
 * way pullHeaderOf itself does — the ladder just moves on to the refusal.
 */
export declare function mirrorStamp(where: {
    vault?: string;
    document: string;
    block: string;
    host: string;
    org: string;
    kb: string;
}): string | null;
/** `org/kb` → both; bare `kb` + a stored org → both; anything else → null. */
export declare function resolveKb(value: string | undefined, storedOrg: string | undefined | null): {
    org: string;
    kb: string;
} | null;
export interface KbOptions {
    sub: string | undefined;
    /** create: the name; open: `<org>/<kb>` or bare `<kb>` */
    target?: string;
    org?: string;
    host?: string;
    print?: boolean;
}
export declare function cmdKb(opts: KbOptions): Promise<number>;
export interface FormatOptions {
    sub: string | undefined;
    kb?: string;
    /** path to the definition file — the GLOBAL --format flag's value */
    file?: string;
    /** the kb_record map key; defaults to the format.name INSIDE the file */
    formatName?: string;
    /** path to a dashboard.yaml to register beside it (omitted = keep stored) */
    dashboard?: string;
    /** register without making it the primary format */
    secondary?: boolean;
    host?: string;
    json?: boolean;
}
export declare function cmdFormat(opts: FormatOptions): Promise<number>;