import { mkdir, writeFile } from 'node:fs/promises';
import { spawn as spawnChild } from 'node:child_process';
import { enrollFleetNode, resolveActiveFleetNodeEnrollment, upsertFleetNodeEnrollment } from '@agent-relay/cloud';
import { preflightPersona, resolveWorkspaceToken } from '@agentworkforce/deploy';
import { fetchDeployments } from './list-command.js';
export declare const LOCAL_SURFACE_USAGE = "usage: agentworkforce local-surface <persona-path> [flags]\n\nRun a proactive persona on this machine, triggered by real provider webhooks\nrouted through the fleet/relaycast infrastructure \u2014 no public IP, tunnel, or\nmanual token wiring required. The persona runs in `--mode dev`; local\ncredential mirroring is NOT supported (workforce#local-surface-plan), so this\nis safe for cron/timer-only or webhook-shape-only personas that don't need a\nper-connection integration credential resolved locally.\n\nRequires a prior cloud deployment: this command resolves the persona's cloud\nDB id from its deployed `agents` row (`agentworkforce deploy ... --mode\ncloud`) and fails loudly if none exists \u2014 both because Cloud only fans\nlocal-surface events out to a persona with an ACTIVE deployment that has real\nwatch config (declared triggers), and because there is no other way for this\ncommand to identify the persona to Cloud. It can't detect a\ndeployed-with-no-watch-config persona from the workforce side (that data\nisn't exposed to the CLI); if events never arrive despite a successful setup,\ncheck that the persona's declared triggers match the event you're expecting.\n\nFlags:\n  --workspace <id>          Workforce workspace to opt in. Defaults to the\n                             active workspace (same resolution as `deploy`).\n  --enrollment-token <tok>  One-time Cloud fleet-node enrollment token\n                             (ocl_node_enr_...), from the Cloud dashboard's\n                             \"Enroll node\" action. Only needed the first time\n                             on this machine \u2014 the resulting node credentials\n                             are persisted and reused on subsequent runs.\n  --enrollment-url <url>    Enrollment redeem endpoint. Defaults to\n                             <cloud-url>/api/v1/fleet/register.\n  --node-name <name>        Fleet node name. Defaults to a channel-derived name.\n  --config-out <file>       Where to write the generated node-config file.\n                             Defaults to\n                             ~/.agentworkforce/local-surface/<persona-id>.mjs\n  --cloud-url <url>         Override WORKFORCE_CLOUD_URL.\n  --json                    Print machine-readable setup info instead of\n                             shelling out to `relay node up` (useful for\n                             scripting / tests).\n  -h, --help                Print this message.\n";
export interface LocalSurfaceOptions {
    personaPath: string;
    workspace?: string;
    enrollmentToken?: string;
    enrollmentUrl?: string;
    nodeName?: string;
    configOut?: string;
    cloudUrl?: string;
    json?: boolean;
}
export type ParsedLocalSurfaceArgs = LocalSurfaceOptions | {
    help: true;
};
export declare function parseLocalSurfaceArgs(args: readonly string[]): ParsedLocalSurfaceArgs;
export interface LocalSurfaceApiResponse {
    channel: string;
    relayWorkspaceId?: string;
}
export interface LocalSurfaceCommandDeps {
    resolveWorkspaceToken: typeof resolveWorkspaceToken;
    resolveActiveFleetNodeEnrollment: typeof resolveActiveFleetNodeEnrollment;
    enrollFleetNode: typeof enrollFleetNode;
    upsertFleetNodeEnrollment: typeof upsertFleetNodeEnrollment;
    preflightPersona: typeof preflightPersona;
    fetchDeployments: typeof fetchDeployments;
    fetch: typeof fetch;
    spawn: typeof spawnChild;
    writeFile: typeof writeFile;
    mkdir: typeof mkdir;
    resolveLocalSurfaceEntry(): string;
    now(): Date;
    log(message: string): void;
    error(message: string): void;
}
export declare function configureLocalSurfaceCommandForTest(overrides: Partial<LocalSurfaceCommandDeps>): () => void;
/**
 * `agentworkforce local-surface <persona-path>` entry.
 *
 * 1. Resolve workspace + token via the same flow `deploy` already uses.
 * 2. Resolve the persona's cloud-side DB UUID from its deployed `agents` row
 *    (`resolveDeployedPersonaUuid`) — fails loudly if none exists. This is a
 *    hard requirement, not just a courtesy check: it's the only way to learn
 *    the UUID `POST /api/v1/fleet/local-surface` needs, and Cloud's
 *    dispatch-time relevance filter only fans events out to a persona's
 *    deployed `agents` row (real watch config) in the first place — opting
 *    into local-surface alone is never sufficient (cloud#2623, dfd446511).
 * 3. Reuse a persisted fleet-node enrollment, or redeem `--enrollment-token`
 *    (minting one requires a browser session — `POST
 *    /api/v1/fleet/enrollment-tokens` is session-cookie-gated, so a headless
 *    CLI can only redeem an already-minted token, via the same
 *    `enrollFleetNode`/`upsertFleetNodeEnrollment` store `relay cloud enroll`
 *    and `relay node up` already read/write).
 * 4. Call `POST /api/v1/fleet/local-surface` to opt the persona in and get
 *    back its bound relaycast channel (session OR `cli:auth`/deploy-scoped
 *    bearer token — `resolveWorkspaceToken()`'s token qualifies).
 * 5. Write a node-config file that default-exports
 *    `defineWorkforcePersonaNode(...)`.
 * 6. Shell out to `relay node up --config <file>`.
 *
 * Sets `process.exitCode` (never calls `process.exit`) so tests can call
 * this directly.
 */
export declare function runLocalSurface(args: readonly string[]): Promise<void>;
//# sourceMappingURL=local-surface-command.d.ts.map