export declare const DATABRICKS_AUTHORING_CERTIFICATION_CHECKS: readonly ["approval-provenance", "jobs-authoring", "lakeflow-authoring", "ai-search-admin", "serving-admin", "uc-admin-obo-execution", "workspace-write", "secrets-write", "genie-authoring"];
/**
 * Tier R checks prove the supported Databricks consumption path. A release certification cannot
 * pass when one of these checks fails or is not configured.
 */
export declare const DATABRICKS_RELEASE_CERTIFICATION_CHECKS: readonly ["identity", "ai-gateway", "sql", "unity-catalog", "uc-denial", "uc-allowed-select", "catalog-preflight-denial", "mutation-approval", "model-serving", "rag", "genie", "managed-mcp", "volumes", "lakebase", "lakebase-app-restart", "dynamic-agent", "lineage", "obo", "system-tables", "actual-cost-reconciliation", "databricks-app"];
/** Tier O checks are preview, SKU-specific, or not part of the default product spine. */
export declare const DATABRICKS_OPTIONAL_CERTIFICATION_CHECKS: readonly ["agent-services", "rag-evaluation", "responses-agent", "ai-search", "genie-agent-mode", "feature-serving", "lakeflow", "jobs", "notebook", "jobs-classic-authoring", "ai-search-delta-sync-admin", "serving-provisioned-throughput-admin"];
export type DatabricksCertificationTier = "R" | "A" | "O";
export type DatabricksCertificationBlockingTier = Exclude<DatabricksCertificationTier, "O">;
/** Return the default certification tier for a built-in check. Custom checks default to Tier O. */
export declare function databricksCertificationTier(checkId: string): DatabricksCertificationTier;
/** Required checks used by the protected Databricks certification workflow. */
export declare function defaultDatabricksCertificationChecks(options?: {
    agentServices?: boolean;
    /** Include protected authoring lifecycles only in a workspace configured for destructive tests. */
    authoring?: boolean;
}): string[];
export type DatabricksCertificationStatus = "passed" | "failed" | "not-configured";
export interface DatabricksCertificationCheck {
    id: string;
    description: string;
    /** Defaults to the built-in taxonomy for known check ids and Tier O for custom checks. */
    tier?: DatabricksCertificationTier;
    configured: boolean;
    run: () => unknown | Promise<unknown>;
}
export interface DatabricksCertificationResult {
    id: string;
    description: string;
    /** Emitted by current runners; optional so retained schema-v2 evidence remains readable. */
    tier?: DatabricksCertificationTier;
    required: boolean;
    status: DatabricksCertificationStatus;
    durationMs: number;
    error?: string;
    details?: Record<string, unknown>;
}
export interface DatabricksCertificationEvidence {
    schemaVersion: 2;
    evidenceId: string;
    startedAt: string;
    generatedAt: string;
    durationMs: number;
    workspaceHost: string;
    workspaceId?: string;
    commitSha?: string;
    workspaceCloud?: string;
    workspaceRegion?: string;
    runtimeVersion?: string;
    packageVersion?: string;
    principalKind?: string;
    authMode?: "pat" | "oauth-m2m" | "app-service-principal" | "on-behalf-of" | string;
    apiVersions: Record<string, string>;
    requiredChecks: string[];
    optionalChecks: string[];
    /** SHA-256 of the exact npm package tarball exercised by this certification run. */
    packageArtifactSha256?: string;
    /** SHA-256 of the immutable Databricks App build directory deployed by the run. */
    artifactSha256?: string;
    /** Digests of recovery, isolation, and other supporting evidence bound to this manifest. */
    relatedEvidenceSha256?: Record<string, string>;
    passed: boolean;
    summary: {
        passed: number;
        failed: number;
        notConfigured: number;
    };
    results: DatabricksCertificationResult[];
}
export interface RunDatabricksCertificationOptions {
    workspaceHost: string;
    checks: DatabricksCertificationCheck[];
    required?: string[];
    /** Require every check in these tiers. Explicit required ids can only add to this set. */
    requiredTiers?: DatabricksCertificationBlockingTier[];
    commitSha?: string;
    secrets?: string[];
    workspaceCloud?: string;
    workspaceRegion?: string;
    workspaceId?: string;
    runtimeVersion?: string;
    packageVersion?: string;
    principalKind?: string;
    authMode?: DatabricksCertificationEvidence["authMode"];
    apiVersions?: Record<string, string>;
    packageArtifactSha256?: string;
    artifactSha256?: string;
    relatedEvidenceSha256?: Record<string, string>;
}
export interface DatabricksCleanupResource {
    kind: string;
    id: string;
    cleanup: () => void | Promise<void>;
}
export interface DatabricksAuthoringLifecycle<Resource, Mutation = Resource> {
    kind: string;
    create: () => Resource | Promise<Resource>;
    identify: (resource: Resource) => string;
    verifyCreated: (resource: Resource) => unknown | Promise<unknown>;
    mutate: (resource: Resource) => Mutation | Promise<Mutation>;
    verifyMutated: (resource: Resource, mutation: Mutation) => unknown | Promise<unknown>;
    delete: (resource: Resource) => void | Promise<void>;
    verifyDeleted: (resource: Resource) => unknown | Promise<unknown>;
}
export interface DatabricksAuthoringLifecycleEvidence {
    kind: string;
    resourceId: string;
    phases: readonly ["create", "verify", "mutate", "verify-mutation", "delete", "verify-delete"];
    cleanupRequired: boolean;
}
/** Reverse-order cleanup ledger for live lifecycle certification. */
export declare class DatabricksCertificationCleanupLedger {
    private readonly resources;
    add(resource: DatabricksCleanupResource): void;
    remove(kind: string, id: string): void;
    pending(): ReadonlyArray<{
        kind: string;
        id: string;
    }>;
    cleanup(): Promise<void>;
}
/**
 * Exercise a destructive authoring capability with mandatory verification and
 * reverse-order cleanup. Callers should perform each operation through the
 * same governed ToolDef path used in production.
 */
export declare function runDatabricksAuthoringLifecycle<Resource, Mutation = Resource>(lifecycle: DatabricksAuthoringLifecycle<Resource, Mutation>, ledger?: DatabricksCertificationCleanupLedger): Promise<DatabricksAuthoringLifecycleEvidence>;
/** Run live capability checks and produce stable, secret-redacted CI evidence. */
export declare function runDatabricksCertification(options: RunDatabricksCertificationOptions): Promise<DatabricksCertificationEvidence>;
//# sourceMappingURL=certification.d.ts.map