/**
 * Remote Execution — SSH transport (2.14.0).
 *
 * The first real transport. It runs remote commands via non-interactive
 * OpenSSH (`BatchMode=yes`, bounded `ConnectTimeout`, no password prompts) and
 * uses PowerShell `-EncodedCommand` (UTF-16LE base64) for Windows command
 * payloads so no shell interpolation of untrusted data ever occurs.
 *
 * Materialisation + launch happen in a single SSH process: a PowerShell
 * preamble reads a JSON payload from stdin, writes base64-decoded files into an
 * execution-scoped temp directory (guarded against duplicate launch), then
 * execs the remote protocol runner. The runner's JSONL frames stream back over
 * the same channel.
 */
import type { RemoteExecutionErrorCode } from "./remote-execution-error.js";
import type { RemoteExecutionTarget, RemoteTargetHealth } from "./remote-target-types.js";
import type { RemoteCommandRunner, RemoteExecutionHandle, RemoteExecutionTransport, RemoteLaunchSpec } from "./remote-transport.js";
export interface SshCommandResult {
    exitCode: number | null;
    signal?: string;
    stdout: string;
    stderr: string;
    timedOut?: boolean;
    launchError?: string;
}
export type SshCommandRunner = (target: RemoteExecutionTarget, args: readonly string[], input: string | Buffer | undefined, options: {
    timeoutMs?: number;
    signal?: AbortSignal;
    sshOptions?: readonly string[];
}) => Promise<SshCommandResult>;
/** Encode a PowerShell script as UTF-16LE base64 for `-EncodedCommand`. */
export declare function encodePowerShellCommand(script: string): string;
/** Build a PowerShell single-quoted literal (escapes embedded single quotes). */
export declare function psLiteral(value: string): string;
/** Build the ssh argv for running a PowerShell encoded command. */
export declare function sshPowerShellArgs(encoded: string): string[];
export interface SshRemoteExecutionTransportOptions {
    /** Injectable command runner (tests). Defaults to real OpenSSH spawn. */
    runner?: SshCommandRunner;
    launchTimeoutMs?: number;
    heartbeatTimeoutMs?: number;
    executionTimeoutMs?: number;
}
export declare class SshRemoteExecutionTransport implements RemoteExecutionTransport, RemoteCommandRunner {
    readonly transportId = "ssh";
    private readonly _runner;
    private readonly _launchTimeoutMs;
    private readonly _heartbeatTimeoutMs;
    private readonly _executionTimeoutMs;
    constructor(options?: SshRemoteExecutionTransportOptions);
    probe(target: RemoteExecutionTarget): Promise<RemoteTargetHealth>;
    /**
     * Run a single bounded remote command with an explicit remote working
     * directory. The command + cwd are passed via stdin JSON (never shell
     * interpolation) to a fixed PowerShell preamble that sets location and runs
     * `cmd.exe /d /s /c`. Used for probe/verification operations.
     */
    runCommand(target: RemoteExecutionTarget, command: string, cwd: string, options?: {
        timeoutMs?: number;
        signal?: AbortSignal;
    }): Promise<{
        exitCode: number | null;
        stdout: string;
        stderr: string;
        timedOut?: boolean;
        launchError?: string;
    }>;
    /**
     * Run an arbitrary encoded PowerShell script with no stdin. Used for
     * runtime-sync operations (hash, directory checks, atomic swap) that are not
     * mission child launches.
     */
    runPowerShell(target: RemoteExecutionTarget, script: string, options?: {
        timeoutMs?: number;
        signal?: AbortSignal;
    }): Promise<{
        exitCode: number | null;
        stdout: string;
        stderr: string;
        timedOut?: boolean;
        launchError?: string;
    }>;
    /**
     * Save binary bytes to a remote file. Reads raw stdin (never JSON), so the
     * payload is byte-exact; used to transfer the runtime bundle tarball.
     */
    saveFile(target: RemoteExecutionTarget, remotePath: string, bytes: Buffer, options?: {
        timeoutMs?: number;
    }): Promise<{
        exitCode: number | null;
        stdout: string;
        stderr: string;
        launchError?: string;
    }>;
    /** Compute the SHA-256 of a remote file (hex). Throws on failure. */
    computeFileSha256(target: RemoteExecutionTarget, remotePath: string): Promise<string>;
    /**
     * Stream-extract a gzipped tarball on the target via `tar -xzf -` (binary
     * stdin). This is the proven reliable path for large binary transfers; tar's
     * gzip CRC32 + tar checksums provide integrity, and the caller verifies the
     * sidecar manifest identity afterwards.
     */
    extractTarballFromStdin(target: RemoteExecutionTarget, destDir: string, bytes: Buffer, options?: {
        timeoutMs?: number;
    }): Promise<{
        exitCode: number | null;
        stdout: string;
        stderr: string;
        launchError?: string;
    }>;
    launch(target: RemoteExecutionTarget, spec: RemoteLaunchSpec, options?: {
        signal?: AbortSignal;
    }): Promise<RemoteExecutionHandle>;
    private _consume;
    private _applyFrame;
}
export type { RemoteExecutionErrorCode };
//# sourceMappingURL=ssh-transport.d.ts.map