import { type Result } from "@fjall/generator";
import { type BackupVaultVerdict } from "@fjall/util";
import { type EngineCompat, type EngineCompatEnvelope } from "@fjall/util/manifest";
/** The distinct outcomes of comparing a running engine against an assembly. */
export type EngineCompatVerdictKind = "ok" | "no-constraint" | "engine-ahead" | "engine-too-old" | "cdk-cli-too-old" | "shape-too-new" | "malformed-constraint" | "indeterminate";
export interface EngineCompatVerdict {
    readonly kind: EngineCompatVerdictKind;
    readonly message: string;
    readonly engineCompat: EngineCompat | undefined;
    readonly runningEngineVersion: string | undefined;
}
export interface EvaluateEngineCompatInput {
    readonly envelope: EngineCompatEnvelope;
    readonly runningEngineVersion: string | undefined;
    readonly maxSupportedManifestVersion: number;
    /**
     * The deploy engine's bundled `aws-cdk` CLI version, for the FM1
     * `minimumAwsCdkCli` cross-tree floor check. Only consulted when the assembly
     * declares a CLI floor; undefined then classifies `indeterminate` (a CLI floor
     * was declared but the running CLI could not be determined → refuse).
     */
    readonly runningAwsCdkCliVersion?: string | undefined;
}
/**
 * Pure classifier — takes a read envelope + the running engine version and
 * returns a verdict, no I/O. The gate policy (refuse / warn / proceed) is
 * applied by `assertEngineCompatibleWithAssembly`; this function only decides
 * WHICH outcome the pairing is.
 */
export declare function evaluateEngineCompat(input: EvaluateEngineCompatInput): EngineCompatVerdict;
export interface AssertEngineCompatibleInput {
    readonly cdkOutPath: string;
    /** Defaults to `DEPLOY_CORE_VERSION` (the running engine). Overridable for tests. */
    readonly runningEngineVersion?: string;
    /**
     * Defaults to the deploy engine's bundled `aws-cdk` CLI version (FM1 floor).
     * Overridable for tests. Note: passing `undefined` re-triggers discovery (JS
     * default-param semantics) — inject a value to force the indeterminate path.
     */
    readonly runningAwsCdkCliVersion?: string;
    /**
     * Programmatic override for embedding callers — mirrors the
     * `FJALL_ALLOW_ENGINE_SKEW` env escape hatch. No production CLI/worker
     * surface threads a flag here (deliberate: the env var is the sole operator
     * surface, uniform across local runs and both CI plugins, which pass env
     * through); the parameter exists for embedders and tests.
     */
    readonly allowEngineSkew?: boolean;
    /** Advisory-warning sink (WARN verdicts + audit-logged overrides). */
    readonly onWarning?: (message: string) => void;
}
/**
 * The deploy-time chokepoint. Reads the assembly's engine-compatibility
 * envelope, classifies the pairing, and returns `failure` for a REFUSE verdict
 * (unless overridden) so the caller short-circuits before any build/push/CFN
 * mutation. WARN and PROCEED verdicts return `success`.
 *
 * Synchronous — the envelope read is `readFileSync` and the classifier is pure,
 * matching the synchronous orchestration context of the deploy pipeline.
 *
 * The returned message carries only version identifiers and static text (never
 * a credential value), so callers may surface it to a log / callback sink
 * directly; the deploy pipeline still routes it through `maskSensitiveOutput`
 * for consistency with its sibling failure paths.
 */
export declare function assertEngineCompatibleWithAssembly(input: AssertEngineCompatibleInput): Result<EngineCompatVerdict, Error>;
/**
 * First `@fjall/components-infrastructure` major whose synth consumes
 * `fjall:capacityIdentity` pins (the D9 anchor model). Fixed historical
 * constant: under Lerna FIXED lockstep the emitter's assemblies stamp
 * `minimumEngineVersion: "7.0.0"`, and every earlier declared floor — or no
 * envelope at all — identifies constructs that silently IGNORE pins. (The
 * rollout plan wrote this floor as 6.0.0 while the emitter targeted that
 * release; 6.0.0 shipped without it, so the anchor model lands in 7.0.0.)
 */
export declare const CAPACITY_PIN_CONSTRUCTS_FLOOR_MAJOR = 7;
export interface AssertCapacityPinsSupportedInput {
    readonly cdkOutPath: string;
    /**
     * The serialised `-c fjall:capacityIdentity=` wire this deploy carries
     * (`DeploymentContext.capacityIdentity`). Undefined when no app on this
     * target is pinned — the tripwire is then a no-op.
     */
    readonly capacityIdentityWire: string | undefined;
    /**
     * The app being deployed — only ITS pins gate this deploy. This is the
     * OPERATION's app name (the on-disk folder for local apps), while the wire
     * is keyed by MANIFEST appName; the gate also reads the assembly's manifest
     * identity and matches both case-insensitively, so a folder-vs-manifest
     * divergence ("web-app" vs "WebApp") refuses loudly instead of silently
     * vacating the tripwire.
     */
    readonly appName: string;
}
/**
 * AC-3.7 downgrade tripwire. A pinned app must never deploy through an
 * assembly synthesised by constructs that predate the pin-consuming anchor
 * model: pre-{@link CAPACITY_PIN_CONSTRUCTS_FLOOR_MAJOR} synth ignores the
 * `fjall:capacityIdentity` context silently and re-derives capacity identity
 * from config, which after any post-pin config change plans an unconsented
 * rename of stateful resources.
 *
 * Deliberately NOT overridable via `FJALL_ALLOW_ENGINE_SKEW`: the skew hatch
 * exists for an operator who has verified a pairing is compatible, but there
 * is nothing to verify here — a Retain-policy volume classifies `retained`,
 * so the rename this gate prevents would sail through the destruction gate
 * without a consent row. Both remedies in the message are direct actions.
 *
 * The failure message carries only app/slot identifiers and version literals
 * (never a credential value), same surfacing contract as its sibling gate.
 */
export declare function assertCapacityPinsSupportedByAssembly(input: AssertCapacityPinsSupportedInput): Result<void, Error>;
/**
 * First `@fjall/components-infrastructure` major whose DisasterRecovery
 * construct reads the `fjallBackupVault` ownership verdict. Earlier constructs
 * read a retired adopt boolean instead, so a re-owned verdict reaches them as
 * no context at all and they synthesise the CREATE template — a new vault and
 * a new key declared under the live name. The engine-ahead skew verdict
 * cannot catch the pairing: it warns only against a declared maximum major,
 * which the constructs never stamp.
 */
export declare const BACKUP_VAULT_VERDICT_CONSTRUCTS_FLOOR_MAJOR = 38;
/**
 * Refuses a re-owned backup-vault verdict against an assembly synthesised by
 * constructs older than {@link BACKUP_VAULT_VERDICT_CONSTRUCTS_FLOOR_MAJOR}.
 * No verdict, `absent`, and owned-with-stack-key all synthesise the create
 * template on every constructs version, so they pass. Deliberately NOT
 * overridable via `FJALL_ALLOW_ENGINE_SKEW`, for the capacity gate's reason:
 * there is nothing for an operator to verify — the older template is wrong
 * by construction. The message carries the vault name and version literals
 * only.
 */
export declare function assertBackupVaultVerdictSupportedByAssembly(cdkOutPath: string, verdict: BackupVaultVerdict | undefined): Result<void, Error>;