import { type ResourceNode } from "../core.js";
import { type Executors } from "./apply.js";
import type { StateBackend } from "./backend/index.js";
import { type BindHarnessRepositoriesOptions } from "./bindHarnessRepository.js";
import { type CompileResult, type State } from "./compile.js";
import { type LoadError } from "./load.js";
export type { ApplyProgress, ApplyResult, Executors, Outputs, } from "./apply.js";
export { apply, OUTPUT_PENDING_DEPLOYMENT_UUID, OUTPUT_PREVIEW_URL, } from "./apply.js";
export type { AuditEntry } from "./audit.js";
export { appendAudit, newRunId } from "./audit.js";
export type { ResolveStateBackendInput, StateBackend, StateBackendMode, StateLease, StateResolution, } from "./backend/index.js";
export { cloudStateBackend, createCloudState, localStateBackend, offlineStateBackend, resolveStateBackend, } from "./backend/index.js";
export type { BindHarnessRepositoriesOptions, BindHarnessRepositoriesResult, } from "./bindHarnessRepository.js";
export { bindHarnessRepositories } from "./bindHarnessRepository.js";
export type { ChangeType, CompileInput, CompileResult, PlanEntry, State, StateEntry, ValidationError, } from "./compile.js";
export { compile } from "./compile.js";
export type { DestroyResult } from "./destroy.js";
export { destroy, removeResources } from "./destroy.js";
export { liveExecutors } from "./executors.live.js";
export type { GitCheckout } from "./git.js";
export { gitRoot, parseGitHubRemote, readGitCheckout, repoRelativeDirectory, } from "./git.js";
export type { ImportResult } from "./import.js";
export { importResource } from "./import.js";
export type { LoadError } from "./load.js";
export { loadResources, loadResourcesCollecting } from "./load.js";
export type { Lock } from "./lock.js";
export { acquireLock } from "./lock.js";
export type { InfoProject, InfoReport, InfoResource, Palette } from "./plan.js";
export { buildInfoReport, formatCheck, formatInfo, formatPlan, } from "./plan.js";
export type { PullOptions, PullProgress, PullResult } from "./pull/index.js";
export { pull, SKIP_REASONS, SUPPORTED_KINDS } from "./pull/index.js";
export type { GeneratedResourceFile } from "./pull/single.js";
export { generateResourceFile } from "./pull/single.js";
export { liveReaders } from "./readers.live.js";
export type { DriftEntry, DriftStatus, LiveRead, LiveReader, LiveReaders, } from "./refresh.js";
export { detectDrift, fingerprint, reconcileDrift } from "./refresh.js";
export type { StateFile } from "./state.js";
export { emptyState, readState, readStateFile, readStateOffline, restoreSnapshot, snapshotState, statePath, writeState, writeStatePointer, } from "./state.js";
export type { LayoutResourceNodesResult } from "./workflowLayout.js";
export { layoutResourceNodes } from "./workflowLayout.js";
/**
 * Bind harness repositories, then compile. The one path from loaded nodes to a
 * plan — every caller that hashes a spec it is about to preview or apply goes
 * through here.
 *
 * It is a seam rather than a step inside `compile` because `compile` is pure:
 * inferring a repository reads the git checkout, which is IO. The first version
 * of this feature bolted the bind onto each caller instead, and three of the
 * six disagreed — a caller that binds differently from `plan` writes a hash
 * that `plan` reads back as a permanent update, and applies a spec nobody
 * previewed.
 *
 * `projectDir` is the directory whose position inside the repo becomes the
 * agent's `rootDirectory`. Callers pass it explicitly because it is *not*
 * `process.cwd()` for all of them: the CLI's `plan` stands in the CDK project
 * (`infra/` in a scaffolded repo) while its `deploy` stands at the repo root,
 * so a cwd-derived directory is exactly the disagreement described above.
 */
export declare function compileProject(input: {
    nodes: readonly ResourceNode[];
    projectDir: string;
    state?: State | undefined;
    draft?: boolean;
    /** Injectable git reader, so the seam is testable without a real checkout. */
    readCheckout?: BindHarnessRepositoriesOptions["readCheckout"];
    /**
     * How to report a deferred env var the plan needs and cannot resolve.
     * `"note"` (the default) keeps the diff readable and exits zero, which is what
     * a preview wants: CI reviews a plan without production secrets. `"error"`
     * aborts, and is what `deploy` passes, because the alternative is discovering
     * it halfway through an apply with resources already created.
     */
    envPolicy?: "note" | "error";
    /**
     * Keys the workspace env-var catalog holds, for checking every
     * `workspaceEnv("KEY")` names one that exists. `undefined` means the catalog
     * was not read — an offline plan, or a failed fetch — and skips that check
     * rather than reporting every pointer as missing.
     *
     * Not consulted for `secret()`, which reads the local environment only.
     */
    workspaceEnvVarKeys?: readonly string[];
}): Promise<CompileResult & {
    nodes: ResourceNode[];
}>;
/**
 * Load a repo's resource definitions, read its deploy state, and compile a
 * plan — the offline diff. No side effects on the workspace.
 *
 * Loads fail-slow (collecting every offending file) and folds those load errors
 * into the result, so `plan` reports EVERY problem in one pass — the same set
 * `check` would, plus the diff. This keeps `check ⊆ plan ⊆ deploy`: a preview
 * never surfaces fewer errors than `cdk check`, mirroring `terraform plan`'s
 * implied validation.
 *
 * Play and tool workflows are laid out before the diff, so the coordinates
 * previewed here are the ones `deploy` writes.
 */
export declare function plan(root: string, draft?: boolean, backend?: StateBackend): Promise<CompileResult>;
/**
 * Fold per-file load failures into a compile result's `errors`, so a preview or
 * deploy aborts with the full list of problems rather than the first bad file.
 * Load errors are prepended: they're the root cause of the cascading "unknown
 * resource" graph errors an unloaded file produces, so they read first.
 */
export declare function withLoadErrors(result: CompileResult, loadErrors: LoadError[]): CompileResult;
/**
 * The aggregated result of `check` — per-file load errors plus the graph diff.
 * `nodes`, `files` (resource id → the file that declared it) and `state` are
 * what `cdk info` renders on top of the same pass; `cdk check` ignores them.
 * `state` is returned rather than re-read so both views of the file are the
 * same one.
 */
export type CheckResult = {
    loadErrors: LoadError[];
    compile: CompileResult;
    nodes: ResourceNode[];
    files: Record<string, string>;
    state: State | undefined;
};
/**
 * Offline validation that reports EVERY violation in one pass: import every
 * resource file collecting per-file failures (body / slug / transpile errors),
 * then compile the graph so workflow layout, token and cycle errors
 * surface alongside them. No side effects on the workspace. Powers `cdk check`.
 *
 * Layout runs inside `compile`, the same path as `plan` and `deploy`, so a
 * green `check` cannot hide a layout failure that would abort the deploy.
 */
export declare function check(root: string, backend?: StateBackend): Promise<CheckResult>;
export type DeployResult = {
    state: State;
    applied: number;
    updated: number;
    skipped: number;
};
/**
 * Load → compile → apply against `executors`, persisting deploy state after
 * every resource. Seeds from the existing state, or an empty state bound to
 * `workspaceUuid` on the first deploy. Throws on validation errors.
 */
export declare function deploy(root: string, workspaceUuid: string, executors: Executors, backend?: StateBackend): Promise<DeployResult>;
//# sourceMappingURL=index.d.ts.map