/**
 * Settings persistence core — atomic read/modify/write of settings.json
 * under the user's home directory. All config domain modules go through
 * readSettings/updateSettings; nothing else touches the file directly.
 *
 * Fail-closed policy (D5 in the 2026-07-26 process-lifecycle plan): a corrupt
 * settings.json must never be silently replaced by `{}` — a single bad read
 * followed by any write used to wipe the whole config. Instead the corrupt
 * file is quarantined, and reads fall back to settings.json.bak, then to the
 * in-memory last-known-good copy, and only throw when no trusted source
 * exists at all.
 */
/**
 * Read and parse the settings file.
 *
 * - ENOENT → `{}` (legitimate first run).
 * - Any other failure → quarantine the corrupt file, then fall back to
 *   settings.json.bak (restoring it as the live file), then to the in-memory
 *   last-known-good copy (also restored as the live file, so the ENOENT
 *   fast-path never fabricates {} on the read after a quarantine). If no
 *   trusted source exists, THROW — callers must
 *   not proceed on a fabricated empty config, because a later write would
 *   persist the wipe.
 */
export declare function readSettings(): Record<string, unknown>;
/**
 * Non-destructive boot-time config health check. Returns a description of a
 * fatal problem, or null when boot may proceed. Unlike readSettings() it never
 * quarantines or writes anything, so a supervisor restart loop keeps hitting
 * the same state (and the same loud message) instead of silently degrading to
 * an ENOENT→{} read on the second boot.
 */
export declare function checkSettingsAtBoot(): string | null;
/**
 * Boot guard against the corrupt-config crash-loop. readSettings() rightly
 * throws when settings.json is corrupt and no trusted fallback exists, but at
 * boot (lastGoodSettings is still null) that surfaces as an opaque uncaught
 * throw from whichever of its many callers runs first — the supervisor
 * restarts, and the loop repeats with no operator signal. Decide explicitly
 * instead: log an actionable line and exit before any config consumer loads.
 */
export declare function assertSettingsSafeAtBoot(): void;
/**
 * Read settings, apply a mutator, and atomically persist the result.
 * Propagates readSettings failures: a mutation is never applied to (and never
 * persists) a fabricated empty config after a failed read.
 */
export declare function updateSettings(mutator: (s: Record<string, unknown>) => void): void;
//# sourceMappingURL=settings-store.d.ts.map