import { spawn as nodeSpawn } from "node:child_process";
import type { RunProcessHandle } from "./daemon.js";
export interface ContainerSpawnConfig {
    /** Container runtime binary: `docker` or `podman`. */
    runtime: string;
    /** Fully-qualified runner image ref (e.g. `ghcr.io/boardwalk-labs/runner:0.1.9`). */
    image: string;
    /** Docker network mode. Default `host` — preserves the machine's LAN/VPN/localhost reach. */
    network?: string;
    /** Extra host bind mounts (`hostPath:containerPath[:ro]`) the user opted into for this fleet. */
    mounts?: readonly string[];
    /** Run the container as this `uid:gid` — the invoking host user — so writes to the bind-mounted
     *  workspace match host ownership instead of the image's `node` (uid 1000). Set on Linux; omit on
     *  Docker Desktop (macOS/Windows), which maps ownership through its file sharing. */
    user?: string;
    /** Test seam. */
    spawn?: typeof nodeSpawn;
}
/** The env the container receives: the claim's env + platform contract, with the in-container
 *  filesystem coordinates overridden (the host paths are meaningless inside the container). */
export declare function containerEnv(runEnv: Record<string, string>): Record<string, string>;
/** The daemon-env subset every spawner forwards into a run (exported for the `--host` spawner). */
export declare function forwardedDaemonEnv(): Record<string, string>;
/** Derive the run id from the per-run workspace path (`<workDir>/runs/<runId>/workspace`). Used only
 *  for a human-readable container name; a fallback keeps a non-standard cwd from throwing. */
export declare function runIdFromCwd(cwd: string): string;
/**
 * Build the `docker run` argv. PURE + exported so the isolation guarantees are unit-asserted:
 *  - the only bind mounts are the per-run workspace, this run's OWN persistence scope (+ any explicit
 *    user mounts) — the identity dir, the user's home, OTHER workflows' persisted workspaces, and the
 *    rest of the host FS are never mounted;
 *  - per-run credentials are passed by NAME (`-e BOARDWALK_RUN_TOKEN`), so their VALUES come from the
 *    docker client's env and never appear in the argv (which `ps` exposes);
 *  - `--rm` (no leftover container), `--init` (proper signal handling / zombie reaping).
 */
export declare function buildContainerArgs(cfg: ContainerSpawnConfig, opts: {
    env: Record<string, string>;
    cwd: string;
}): string[];
/** A `RunSpawner` that runs each run in a throwaway container. */
export declare function createContainerSpawner(cfg: ContainerSpawnConfig): (opts: {
    entry: string;
    env: Record<string, string>;
    cwd: string;
}) => RunProcessHandle;
/** Probe that a container runtime is installed AND its daemon is reachable. Returns the runtime
 *  binary name on success, or null (so `start` can hard-fail with a clear message rather than
 *  failing every run later). `docker info` / `podman info` exits non-zero when the daemon is down. */
export declare function detectContainerRuntime(candidates?: readonly string[], run?: (bin: string) => Promise<void>): Promise<string | null>;