import { type Server } from 'node:net';
import type { SecretCache } from './cache';
export declare const DEFAULT_AGENT_CANDIDATE_READY_SOCKET = "/run/forgezero/candidate-ready.sock";
export interface VaultReplicationCursor {
    projectKey: string;
    version: number;
    entryCoordinatesDigest: string;
    entryCount: number;
    synchronizedAtTs: number;
    resyncRequired: boolean;
}
export interface AgentLeaseCoordinate {
    kind: 'deployment' | 'provisioning' | 'migration' | 'bootstrap' | 'metal-admission';
    key: string;
    attempt: number;
    expiresAtTs: number;
}
/** Versioned, non-secret state sent by the active Agent through the root update helper. */
export interface AgentRuntimeHandoff {
    format: 1;
    nodeKey: string;
    vaultCursor: VaultReplicationCursor | null;
    /** Requested-entry coordinates only; values are re-fetched over the authenticated node API. */
    entryCoordinates: readonly string[];
    activeLeases: readonly AgentLeaseCoordinate[];
}
export interface AgentHandoffAcknowledgement {
    format: 1;
    vaultCursor: VaultReplicationCursor | null;
    residentVaultVersion: number | null;
    activeLeaseDigest: string;
    activeLeaseCount: number;
    acknowledgedAtTs: number;
}
export interface AgentCandidateReady {
    version: string;
    nodeKey: string;
    bound: boolean;
    vault: 'ready' | 'partial' | 'unavailable' | 'unbound';
    handoff?: AgentHandoffAcknowledgement;
}
export interface AgentCandidateExpectation {
    version: string;
    nodeKey: string;
    bound: boolean;
    vault: readonly AgentCandidateReady['vault'][];
    handoff?: AgentRuntimeHandoff;
}
export declare const activeLeaseDigest: (leases: readonly AgentLeaseCoordinate[]) => string;
export declare function agentRuntimeHandoff(args: {
    nodeKey: string;
    projectKey?: string;
    cache?: Pick<SecretCache, 'names' | 'cursor'>;
    activeLeases?: readonly AgentLeaseCoordinate[];
    now?: number;
}): AgentRuntimeHandoff;
/**
 * Reconstruct the active requested-entry set before acknowledging handover.
 *
 * Plaintext never crosses the lifecycle socket. A candidate uses its existing
 * node identity to re-fetch each coordinate and advances its server cursor. If
 * the API/Vault is unavailable, this fails and the old Agent remains serving.
 */
export declare function reconcileAgentRuntimeHandoff(args: {
    expected: AgentRuntimeHandoff;
    nodeKey: string;
    projectKey?: string;
    cache?: Pick<SecretCache, 'get' | 'names' | 'sync' | 'cursor'>;
    now?: number;
}): Promise<AgentHandoffAcknowledgement>;
/** New proxy connections resolve the new backend; established streams are untouched. */
export declare function switchAgentSocketRoute(route: string, backend: string): void;
/** Root-observable readiness appears only after identity, binding and Vault initialization. */
export declare function startAgentCandidateReady(ready: AgentCandidateReady, socketPath?: string, reconcile?: (expected: AgentRuntimeHandoff) => Promise<AgentHandoffAcknowledgement>): Server;
export declare function probeAgentCandidate(expected: AgentCandidateExpectation, socketPath?: string, timeoutMs?: number): Promise<boolean>;