/**
 * PreferencesReplicatedStore — the FIRST concrete consumer of the HLC
 * replicated-store foundation (WS2.1, multi-machine-replicated-store-foundation
 * §4 + §7.2 + §13). It layers the `pref-record` replicated kind onto the generic
 * substrate (ReplicatedRecordEnvelope / UnionReader / ConflictStore /
 * RollbackUnmerge / ReplicationBudget / StoreSnapshot) so a user preference
 * learned on machine A is honored on machine B — ONE memory, not one-per-machine.
 *
 * THIS IS PURE LOGIC. No fs, no Date directly, no network. It defines:
 *   A. The `pref-record` store schema (the StoreFieldSchema the registry validates
 *      on top of the envelope) + the store's IMPACT TIER (high) + per-kind bounds.
 *   B. The emit-envelope builder: PreferenceEntry → the `data` object a journal
 *      `pref-record` entry carries (recordKey=dedupeKey, hlc, op, origin, observed).
 *   C. The union-aware read: a `Map<recordKey, UnionResult>` (from
 *      ReplicatedStoreReader.readAll('preferences')) → a `PreferenceEntry[]` for
 *      the session-start block. THE LOAD-BEARING ADVISORY RECONCILIATION (the §15.1
 *      decision): on an OPEN conflict for a dedupeKey, BOTH variants are injected as
 *      hints — they ARE advisory, both are usable guidance — rather than blocking on
 *      operator resolution. Operator resolution (POST /state/resolve-conflict) is
 *      OPTIONAL cleanup that collapses the flag; it is NEVER a gate on the hint
 *      being injected. A flag is observability + optional cleanup, not a blocked
 *      preference. This is what kills the §15.1 over-flag-fatigue concern.
 *
 * SUPERSESSION (CMT-1416): this foundation path SUPERSEDES the earlier advisory
 * `PreferencesSync.ts` (the seamlessness-spec WS2.1, behind
 * multiMachine.seamlessness.ws21PreferencesPool). BOTH ship dark/default-off, so
 * there is ZERO runtime duplication today. PreferencesSync is retained dark until
 * this path is validated, then removed (tracked CMT-1416 — a separate cleanup PR).
 * They are MUTUALLY EXCLUSIVE in practice: the consumer reads ONE path at a time
 * (the foundation reader is consulted only when `multiMachine.stateSync.preferences`
 * is enabled; the legacy merge only when `seamlessness.ws21PreferencesPool` is). An
 * operator who enables BOTH gets the foundation path's precedence (it is the
 * principled substrate); the legacy path is the fallback for an agent that has not
 * yet flipped to the foundation flag.
 *
 * SAFETY POSTURE (§14): MECHANISM, dark by default. Nothing here blocks a
 * user-initiated action. `violationPattern` (the operator's self-violation
 * detection regex/keywords) is a LOCAL-ONLY signal that reveals the operator's
 * security posture, so it is NEVER part of the replicated store schema and is
 * stripped from every emitted envelope (mirrors PreferencesSync finding #1).
 */
import type { PreferenceEntry } from './PreferencesManager.js';
import type { StoreFieldSchema, ReplicatedEnvelope, ReplicatedOp } from './ReplicatedRecordEnvelope.js';
import type { ImpactTier, OriginRecord, UnionResult } from './UnionReader.js';
import type { ReplicatedKindBounds } from './ReplicationBudget.js';
import type { HlcTimestamp } from './HybridLogicalClock.js';
/** The stateSync config sub-key + advert suffix for this store (e.g.
 *  `multiMachine.stateSync.preferences.enabled`). Equal to the advert flag key
 *  `stateSyncReceive['preferences']`. */
export declare const PREF_STORE_KEY = "preferences";
/** The JournalKind string this store rides — the DUAL-REGISTRY's dynamic half.
 *  MUST also be present in CoherenceJournal.JOURNAL_KINDS (the static half), or the
 *  store advertises receive=true yet serves/applies/pulls nothing (§4 callout). */
export declare const PREF_RECORD_KIND = "pref-record";
/**
 * Preferences are HIGH-impact (spec §614 / master-spec decision 2): a concurrent
 * divergent edit to the SAME dedupeKey from different origins goes through
 * APPEND-BOTH-AND-FLAG — both versions preserved, ONE deduped conflict, never a
 * silent overwrite. (The CONSUMER read path still injects BOTH variants as advisory
 * hints — see mergeUnionToPreferences — so the flag never suppresses guidance.)
 */
export declare const PREF_IMPACT_TIER: ImpactTier;
/**
 * Per-kind replication bounds (§8). Preferences are FEW — a tight window with a
 * coalescing rate cap (the burst of edits to one dedupeKey collapses to the latest
 * state per interval). Mirrors the PreferencesSync precedent's per-store cap
 * (DEFAULT_MAX_REPLICATED_PREFERENCES=500). The retention here matches the
 * journal-level `pref-record` fallback in CoherenceJournal.DEFAULT_RETENTION; the
 * aggregate journal budget (64 MiB default) trivially covers a 2 MiB pref stream.
 */
export declare const PREF_RECORD_BOUNDS: ReplicatedKindBounds;
/**
 * The store-specific field names the `pref-record` schema OWNS (the unknown-field
 * counter's allowlist). NOTE: `violationPattern` is DELIBERATELY ABSENT — it is a
 * LOCAL-ONLY signal (the operator's self-violation regex/keywords) that must never
 * replicate (PreferencesSync finding #1). `dedupeKey` is ABSENT too — it is the
 * recordKey (a reserved envelope field), never a store field. `lastMutatedSeq`,
 * `storeIncarnation` etc. are local replication bookkeeping, never replicated here.
 */
export declare const PREF_STORE_KNOWN_FIELDS: ReadonlyArray<string>;
/** Caps mirroring the PreferencesManager discipline — a value over the cap REJECTS
 *  the whole record (never truncate-and-accept). */
export declare const MAX_LEARNING_LENGTH: number;
export declare const MAX_PROVENANCE_LENGTH = 64;
/**
 * The `pref-record` store schema (§4). Strict typed validation on top of the
 * envelope: reject free text beyond the known fields, jail any path-shaped string,
 * narrow each field. Returns the validated store-specific object, or null to reject
 * the WHOLE record. PURE (no I/O, no mutation of `raw`).
 */
export declare const prefRecordStoreSchema: StoreFieldSchema;
/** The `data` object a `pref-record` journal entry carries: the validated store
 *  fields PLUS the envelope fields. Deterministic shape; `observed` omitted when
 *  absent. */
export type PrefRecordData = Record<string, unknown>;
/** The credential scrubber seam (injected so this module stays pure — the real
 *  wiring passes `redactForLiveTail`). Returns the scrubbed text + whether anything
 *  was redacted. */
export type LearningScrubber = (input: string) => {
    text: string;
    redactedCount: number;
};
/** Input to buildPrefRecordData: the entry to emit, the freshly-ticked hlc, the op,
 *  this machine's origin id, and the observed-witness (the hlc already merged for
 *  THIS dedupeKey before writing, or absent). */
export interface BuildPrefRecordInput {
    entry: Pick<PreferenceEntry, 'learning' | 'confidence' | 'dedupeCount' | 'provenance' | 'recordedAt' | 'dedupeKey'>;
    hlc: HlcTimestamp;
    op: ReplicatedOp;
    origin: string;
    /** The HLC already merged for THIS dedupeKey before writing, or absent (§7.2). */
    observed?: HlcTimestamp;
    /** Credential scrubber applied to `learning` at emit time (PreferencesSync finding
     *  #5: usefulness never depends on the scan — a flagged learning still replicates,
     *  redacted). Omitted ⇒ no scrub (the in-process default is to pass the real
     *  scrubber). */
    scrub?: LearningScrubber;
}
/**
 * Build the `pref-record` envelope `data` for emission (§4). recordKey = the
 * preference `dedupeKey` (the natural primary key — the same dedupeKey on two
 * machines is the SAME learned lesson). `violationPattern` is NEVER included (local-
 * only). `learning` is credential-scrubbed when a scrubber is supplied. The returned
 * object is the journal entry's `data`; the envelope fields are authoritative.
 *
 * NOTE: this does NOT validate — it produces a well-formed `data` the journal emit
 * path serializes; the RECEIVE door (validateReplicatedEnvelope + the store schema)
 * re-validates on apply. Emission is GATED upstream by
 * `multiMachine.stateSync.preferences.enabled` (the caller checks
 * isStoreEmissionEnabled before calling this) — when off, this is never reached.
 */
export declare function buildPrefRecordData(input: BuildPrefRecordInput): PrefRecordData;
/**
 * Reconstruct a PreferenceEntry from an OriginRecord's store `data` (the envelope
 * fields stripped). Defensive: a field that does not narrow falls back to the same
 * safe default PreferencesManager.read() uses. `dedupeKey` is the recordKey.
 */
export declare function prefEntryFromOriginRecord(rec: OriginRecord): PreferenceEntry;
/**
 * Build an OriginRecord for the OWN preference store (the single-origin
 * materialization the union reader merges). recordKey = dedupeKey; the envelope
 * carries a SYNTHETIC own-origin stamp. NOTE: this is the OWN record at rest — it
 * is NOT the wire/journal hlc (that is minted by clock.tick() at the EMIT path);
 * here we only need a stable own-origin record for the union to merge against peer
 * replicas. `lastMutatedSeq` is folded into a deterministic logical counter so the
 * own record has a well-formed, monotone HLC position relative to its own edits.
 * `violationPattern` is NEVER carried into the replicated namespace (local-only).
 */
export declare function prefEntryToOriginRecord(entry: PreferenceEntry, origin: string): OriginRecord;
/**
 * THE LOAD-BEARING ADVISORY RECONCILIATION (§15.1 decision, recorded verbatim).
 *
 * Collapse a `Map<recordKey, UnionResult>` (from
 * ReplicatedStoreReader.readAll('preferences')) into the PreferenceEntry[] the
 * session-start block consumes. The §15.1 contract:
 *   - A resolved single value ⇒ inject that one entry.
 *   - An OPEN HIGH-impact conflict ⇒ inject BOTH (all) concurrent variants as
 *     separate hints. They ARE advisory — both are usable guidance — so the open
 *     conflict NEVER suppresses a usable hint. Operator resolution (POST
 *     /state/resolve-conflict) is OPTIONAL cleanup that collapses the flag; it is
 *     NEVER a gate on the hint being injected.
 *   - A LOW-impact divergence ⇒ the HLC-winner is `value`; inject it (the overwrite
 *     was flagged for observability, but the value is usable).
 *   - A null `value` with no conflict (every origin deleted, or no record) ⇒ nothing
 *     to inject for that key.
 *
 * This is the proof obligation the §12 wiring test exercises: an OPEN conflict for a
 * dedupeKey STILL yields both variants in the output (it can never suppress a usable
 * hint waiting on operator resolution). The conflict's `versions` carry every
 * concurrent origin's record; we map EACH to a PreferenceEntry hint.
 *
 * Determinism: variants from a conflict are emitted in the union reader's stable
 * (HLC-sorted) version order, so the injected block is stable across reads.
 */
export declare function mergeUnionToPreferences(union: Map<string, UnionResult>): PreferenceEntry[];
/**
 * Build the session-start preferences block from a union read (the foundation
 * path's equivalent of PreferencesManager.sessionContext()). Reuses the SAME
 * deterministic, byte-bounded, priority-ordered renderer
 * (`formatPreferencesForSessionStart`) so the injected block shape is identical to
 * the single-machine path — only the SOURCE differs (the no-clobber union vs the
 * local store). An open conflict yields BOTH variants in the block (§15.1).
 */
export declare function buildUnionSessionContext(union: Map<string, UnionResult>, maxBytes?: number): {
    present: boolean;
    block: string;
    count: number;
    scope: 'mesh';
};
/** The ReplicatedKindRegistry registration for the `pref-record` store. server.ts
 *  registers this onto the shared registry; the dual-registry coupling test asserts
 *  `kind` is also present in JOURNAL_KINDS. */
export declare const PREF_KIND_REGISTRATION: {
    readonly kind: "pref-record";
    readonly store: "preferences";
    readonly schema: StoreFieldSchema;
};
/** Convenience re-export for the rollback-unmerge `kindsForStore('preferences')`
 *  wiring + any caller that needs the store's contributing journal kinds. */
export declare function prefContributingKinds(): string[];
/**
 * The store's impact tier resolver, for ReplicatedStoreReader.tierOf. Returns the
 * preferences tier (high) for the `preferences` store. An UNKNOWN store also
 * resolves to `high` — the CONSERVATIVE direction (append-both-and-flag never
 * silently clobbers), so a future store wired before its own tierOf lands can never
 * accidentally get the silent-overwrite path. The reader composes per-store; this is
 * the default a server wires for the preferences store specifically.
 */
export declare function prefTierOf(_store: string): ImpactTier;
/** Re-export the envelope type for callers building/applying pref-record envelopes. */
export type { ReplicatedEnvelope };
//# sourceMappingURL=PreferencesReplicatedStore.d.ts.map