/**
 * Local dev entry point for exercising a server-setup recipe **through the exact
 * production execution path**, without the API, the command-dispatch service,
 * JIT token issuance, or KMS.
 *
 * The whole point is fidelity: a recipe run locally must generate the same
 * enclosing play, pass through the same authoritative task guard, and invoke
 * `ansible-playbook` the same way a real `server_setup_exec` command does — so
 * this module assembles an `ExecuteServerSetupAnsibleInput` from local files /
 * flags and hands it to the shared core (`executeServerSetupAnsible`) that
 * `runServerSetup` also calls. It never re-implements play generation, the
 * guard, or the ansible invocation, and it never disables validation: the guard
 * re-runs inside `executeServerSetupAnsible` regardless of what this module
 * passes in.
 *
 * SECURITY: this reads a plaintext SSH private key (or password) from local
 * disk. It is a developer tool, deliberately NOT wired into `src/index.ts`'s
 * customer-facing commander surface (see `server-setup-local-run.cli.ts`).
 */
import { type CommandResult, type SshExecCredential } from '../types';
/**
 * Options for a local server-setup run. Mirrors what `runServerSetup` would
 * otherwise obtain from the payload + JIT API fetches, but sourced from local
 * files / flags instead.
 */
export interface ServerSetupLocalRunOptions {
    /** Path to the recipe body: a file containing a top-level YAML list of Ansible tasks. */
    bodyPath: string;
    /** Optional path to a JSON file of `ANSIBLE#` project variables (`Record<string, string>`). */
    extraVarsPath?: string;
    /** Names within extra-vars that are secrets — drives `no_log` + output redaction. */
    secretNames?: string[];
    /** Target SSH hostname or IP. */
    hostname: string;
    /** Target SSH username. */
    username: string;
    /** Target SSH port (default 22). */
    port?: number;
    /** SSH auth type: `'privateKey'` (default) or `'password'`. */
    authType?: string;
    /**
     * Path to a file holding the private key material (key auth) or the password
     * (password auth). This file path is the ONLY way to supply the secret — an
     * inline `--key-inline` flag was deliberately removed so key material / the
     * password never appears in argv (`ps`, `/proc/<pid>/cmdline`, shell history).
     */
    privateKeyPath?: string;
    /** When true, validate under the strict `ecs` allowlist instead of the default lenient `resident`. */
    strict?: boolean;
    /** Overrides the known_hosts namespace host id (default `local-host`). */
    sshHostId?: string;
}
/**
 * Parse the recipe body YAML and assert it is a top-level list — the shape the
 * task guard requires. Returns the parsed tasks so callers can report a count;
 * the *original* YAML string is what gets handed to the guard downstream, so
 * this is validation-only and never reshapes the body.
 *
 * @throws Error with an actionable message when the YAML is invalid or not a list.
 */
export declare function parseBodyTasks(rawYaml: string): Record<string, unknown>[];
/**
 * Parse the extra-vars JSON into the `Record<string, string>` shape the
 * production path uses for `extra-vars.json`. Strict — no coercion of non-string
 * values (フォールバック禁止): a malformed file fails loudly rather than
 * silently injecting a value ansible would render differently than intended.
 *
 * @throws Error with an actionable message when the JSON is invalid or not a
 *   flat object of string values.
 */
export declare function parseExtraVars(rawJson: string): Record<string, string>;
/**
 * Assemble the `SshExecCredential` from local options, validating the auth type
 * up front (フォールバック禁止 — an unknown auth type must not silently take the
 * key path). Connection-field shape (hostname/username/port) is NOT validated
 * here — `runServerSetupLocalRun` runs the shared production
 * `validateSshCredential` (`HOSTNAME_RE`/`USERNAME_RE`/`isValidPort`) on the
 * assembled credential before handing it to the core, exactly as
 * `runServerSetup` does, so this only handles what is specific to the local
 * sourcing.
 *
 * @throws Error on missing required connection fields, unsupported auth type, or
 *   unresolvable key material.
 */
export declare function buildLocalCredential(options: ServerSetupLocalRunOptions): SshExecCredential;
/**
 * Warn (to stderr) when extra-vars are supplied but no `--secret-names` were
 * given. Without `--secret-names`, none of the extra-vars values are treated as
 * secrets, so they are NOT `no_log`-annotated and are NOT redacted from the
 * console output — a plaintext value could surface in a task message / stderr.
 * This is non-fatal (a dev tool intentionally keeps running), but the warning
 * makes the exposure explicit so the developer can add `--secret-names`.
 */
export declare function warnIfSecretsUnmasked(variables: Record<string, string>, secretNames: readonly string[]): void;
/**
 * Run a server-setup recipe locally through the production core
 * (`executeServerSetupAnsible`). Reads the body / extra-vars from disk, builds
 * and validates the credential, and delegates everything downstream (known_hosts
 * resolution, play generation, guard re-validation, ansible invocation,
 * redaction, temp-dir cleanup) to the shared core.
 *
 * Returns an `errorResult` (never throws) for every expected user error —
 * missing/invalid files, bad connection info — so the caller always gets a
 * `CommandResult`.
 */
export declare function runServerSetupLocalRun(options: ServerSetupLocalRunOptions): Promise<CommandResult>;
/**
 * Map raw CLI arguments (`process.argv.slice(2)`) to
 * `ServerSetupLocalRunOptions`. Kept here (not in the thin CLI bootstrap) so it
 * is unit-testable. Unknown flags fail loudly rather than being ignored.
 *
 * @throws Error on an unknown flag or a flag missing its value.
 */
export declare function parseLocalRunArgs(argv: readonly string[]): ServerSetupLocalRunOptions;
/** Render a `CommandResult` from a local run as a human-readable, multi-line string. */
export declare function formatLocalRunResult(result: CommandResult): string;
//# sourceMappingURL=server-setup-local-run.d.ts.map