/**
 * CommitmentMutation — P1.5b of multi-machine coherence: owner-routed
 * mutation. "Mark it delivered" works from ANY machine: a non-owner forwards
 * ONE signed `commitment-mutate` to the owner, which applies it through
 * verdict-bearing wrappers around the unchanged CommitmentTracker state
 * machine; an unreachable owner gets a durable pending-mutation that
 * re-issues a FRESH envelope on the owner's return.
 *
 * Spec: docs/specs/COMMITMENTS-COHERENCE-SPEC.md §3.4.
 *
 * Load-bearing rules:
 *  - VERDICT-BEARING wrappers (round-1: the tracker's null-on-terminal
 *    collapses "already delivered" and "not found" — outcomes the caller
 *    must distinguish): applied | idempotent-noop | invalid-transition |
 *    not-found.
 *  - opKey idempotency, DURABLE ON THE OWNER (the envelope nonce window is
 *    only 60s — this window is the replay control; it survives restarts;
 *    a replayed/re-fired mutate returns the recorded verdict, applies
 *    nothing). Written AFTER the store write; a crash between resolves as
 *    idempotent-noop on the re-fire.
 *  - The queue stores INTENT, never a signed envelope: at fire time the
 *    forwarder re-issues a FRESH signed command, so the owner always
 *    evaluates a live, fully-verified envelope (no stale-timestamp paradox;
 *    the durable queue is never an unauthenticated apply surface).
 *  - Bounds: maxPendingOpsPerCommitment (4) per (origin,id);
 *    maxPendingOpsPerOwner (64) — one peer cannot stage an unbounded
 *    transition batch.
 *  - verifyEnvelope is the SOLE authority for the verb (its RBAC case
 *    admits any registered peer by design); the owner's state machine
 *    re-validates every transition — mesh adds reach, not authority.
 */
import type { CommitmentTracker } from '../monitoring/CommitmentTracker.js';
export declare const DEFAULT_OPKEY_TTL_DAYS = 7;
export declare const DEFAULT_MAX_PENDING_PER_COMMITMENT = 4;
export declare const DEFAULT_MAX_PENDING_PER_OWNER = 64;
export declare const DEFAULT_PENDING_MUTATION_TTL_DAYS = 7;
export type CommitmentMutateOp = 'deliver' | 'withdraw' | 'resume' | 'patch-beacon' | 'probe' | 'transition';
export type MutateVerdict = 'applied' | 'idempotent-noop' | 'invalid-transition' | 'not-found';
export interface CommitmentMutatePayload {
    /** Composite identity (§3.1) — a bare id NEVER routes across machines. */
    origin: string;
    id: string;
    op: CommitmentMutateOp;
    args?: Record<string, unknown>;
    /** Caller-generated idempotency key (crypto.randomUUID). */
    opKey: string;
    requestedAt: string;
    callerMachineId: string;
    /** The status the caller observed (stale-view annotation, §3.4). */
    observedStatus?: string;
}
export interface MutateOutcome {
    verdict: MutateVerdict;
    /** Set when the caller acted on a stale view (observedStatus mismatch). */
    staleObservation?: boolean;
    status?: string;
}
/**
 * Apply one op through the UNCHANGED tracker state machine, returning a
 * DISTINCT verdict. The tracker's own methods stay byte-identical — this
 * wrapper only disambiguates outcomes they collapse.
 */
export declare function applyOwnerMutation(tracker: CommitmentTracker, payload: CommitmentMutatePayload): Promise<MutateOutcome>;
/**
 * Bounded durable replay window: applied opKeys persist with their verdict
 * (TTL ≥ the pending-mutation TTL); a replay returns the recorded verdict
 * and applies NOTHING. Single-writer (only the verb handler), atomic
 * temp+rename, corrupt → quarantine + fresh (worst case one idempotent
 * re-apply through the CAS).
 */
export declare class OpKeyWindow {
    private readonly file;
    private readonly ttlMs;
    private readonly now;
    private data;
    constructor(config: {
        stateDir: string;
        ttlDays?: number;
        now?: () => Date;
    });
    /** The recorded verdict for a replayed opKey, or null when unseen. */
    check(opKey: string): MutateOutcome | null;
    /** Record an outcome AFTER the store write (§4.5 ordering). */
    record(opKey: string, outcome: MutateOutcome): void;
    private load;
}
export interface PendingMutationRecord {
    payload: CommitmentMutatePayload;
    createdAt: string;
    attempts: number;
    lastAttemptAt: string | null;
}
/**
 * The P2 PendingPullLedger pattern verbatim: serialized mutate() funnel
 * (single-writer — the six-mutators lesson), corrupt-quarantine (never
 * silently empty), TTL with one honest expiry notice, per-(origin,id) and
 * per-owner enqueue bounds. Stores INTENT only; the re-fire issues a FRESH
 * signed envelope.
 */
export declare class PendingMutationLedger {
    private readonly file;
    private readonly ttlMs;
    private readonly maxPerCommitment;
    private readonly maxPerOwner;
    private readonly now;
    private readonly onCorrupt?;
    private readonly onExpired?;
    private readonly logger;
    private queue;
    private records;
    private corruptNotified;
    constructor(config: {
        stateDir: string;
        ttlDays?: number;
        maxPerCommitment?: number;
        maxPerOwner?: number;
        now?: () => Date;
        onCorrupt?: (qPath: string) => void;
        onExpired?: (rec: PendingMutationRecord) => void;
        logger?: (msg: string) => void;
    });
    /**
     * Queue an intent. Idempotent on opKey; refused ('bounded') past the
     * per-(origin,id) or per-owner caps.
     */
    enqueue(payload: CommitmentMutatePayload): Promise<'queued' | 'duplicate' | 'bounded'>;
    /** Pending intents for a returning owner, oldest-first (drain order). */
    pendingForOwner(origin: string): Promise<PendingMutationRecord[]>;
    /** A resolved intent (any verdict) clears its record. */
    clear(opKey: string): Promise<void>;
    recordAttempt(opKey: string): Promise<void>;
    /** TTL sweep — each expiry surfaced ONCE via onExpired, then removed. */
    sweepExpired(): Promise<PendingMutationRecord[]>;
    /** Composite keys with in-flight intents — the merge layer's join (§3.3). */
    pendingKeys(): Promise<Set<string>>;
    private mutate;
    private read;
    private readUnqueued;
    private persist;
}
//# sourceMappingURL=CommitmentMutation.d.ts.map