declare const DEFAULT_PROFILE = "default";
type ProfileStoreName = "session" | "additional-delegations" | "auth-requests";
interface StoreMetadata {
    formatVersion: number;
}
interface ProfileStoreContents<T> {
    formatVersion: number;
    records: T[];
}
interface ProfileLockOptions {
    timeoutMs?: number;
    retryMs?: number;
    staleAfterMs?: number;
}
declare class ProfileLockTimeoutError extends Error {
    readonly code = "PROFILE_LOCK_TIMEOUT";
    constructor(profile: string, timeoutMs: number);
}
/**
 * The CLI's delegated-secret path treats TC_HOME as a home directory, rather
 * than a direct TinyCloud directory. Keep the shared store on that convention.
 */
declare function tinycloudHomePath(): string;
/** Run one operation against an isolated TinyCloud home directory. */
declare function withTinyCloudStateRoot<T>(stateRoot: string | undefined, action: () => Promise<T>): Promise<T>;
declare function tinycloudConfigPath(): string;
declare function profilesPath(): string;
declare function profilePath(profile: string): string;
declare function profileConfigPath(profile: string): string;
declare function sessionPath(profile: string): string;
declare function additionalDelegationsPath(profile: string): string;
declare function authRequestsPath(profile: string): string;
declare function profileStorePath(profile: string, store: ProfileStoreName): string;
/** The format record is deliberately separate from each legacy JSON payload. */
declare function profileStoreMetadataPath(profile: string, store: ProfileStoreName): string;
declare function profileLockPath(profile: string): string;
declare function profileLockMetadataPath(profile: string): string;
/**
 * Reads JSON without hiding malformed or inaccessible files. A missing file is
 * the only condition represented as null.
 */
declare function readJson<T>(filePath: string): Promise<T | null>;
/**
 * Writes the same pretty-printed, trailing-newline JSON shape used by the CLI,
 * but publishes it with an atomic rename from the same directory.
 */
declare function writeJsonAtomic(filePath: string, value: unknown): Promise<void>;
declare function readProfile<T extends object = Record<string, unknown>>(profile: string): Promise<T | null>;
declare function readSession<T extends object = Record<string, unknown>>(profile: string): Promise<T | null>;
declare function readAdditionalDelegations<T = Record<string, unknown>>(profile: string): Promise<T[]>;
declare function readAuthRequests<T = Record<string, unknown>>(profile: string): Promise<T[]>;
declare function readStoreMetadata(profile: string, store: ProfileStoreName): Promise<StoreMetadata>;
declare function readProfileStore<T>(profile: string, store: Exclude<ProfileStoreName, "session">): Promise<ProfileStoreContents<T>>;
/**
 * Runs a small critical section under the one advisory lock shared by all
 * profile stores. Lock release verifies its ownership token before removing
 * the exact metadata instance it acquired.
 */
declare function withProfileLock<T>(profile: string, action: () => Promise<T>, options?: ProfileLockOptions): Promise<T>;
/**
 * Appends a record or replaces the existing record with the supplied explicit
 * key. The extractor is supplied by the owning store so state.ts never needs
 * to know permission-request or delegation record shapes.
 */
declare function upsertProfileRecord<T>(profile: string, store: Exclude<ProfileStoreName, "session">, key: string, record: T, getKey: (candidate: T) => string | undefined, options?: ProfileLockOptions): Promise<T[]>;
/**
 * Performs a typed read-modify-write of a legacy array store under the one
 * per-profile lock. The payload stays an array and the sibling metadata stays
 * format 1, so existing CLI readers keep their byte/layout contract.
 */
declare function updateProfileStore<T, Result>(profile: string, store: Exclude<ProfileStoreName, "session">, update: (records: readonly T[]) => Promise<{
    readonly records: readonly T[];
    readonly result: Result;
}> | {
    readonly records: readonly T[];
    readonly result: Result;
}, options?: ProfileLockOptions): Promise<Result>;
declare function writeSession<T extends object>(profile: string, session: T, options?: ProfileLockOptions): Promise<void>;
declare function removeSession(profile: string, options?: ProfileLockOptions): Promise<void>;

export { DEFAULT_PROFILE, type ProfileLockOptions, ProfileLockTimeoutError, type ProfileStoreContents, type ProfileStoreName, type StoreMetadata, additionalDelegationsPath, authRequestsPath, profileConfigPath, profileLockMetadataPath, profileLockPath, profilePath, profileStoreMetadataPath, profileStorePath, profilesPath, readAdditionalDelegations, readAuthRequests, readJson, readProfile, readProfileStore, readSession, readStoreMetadata, removeSession, sessionPath, tinycloudConfigPath, tinycloudHomePath, updateProfileStore, upsertProfileRecord, withProfileLock, withTinyCloudStateRoot, writeJsonAtomic, writeSession };
