import { finalizeCloudflareBootstrapAcceptance, runAttendedCloudflareBootstrap, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapEvidence } from './cloudflare-bootstrap';
import { applyOperatorPlatformFleetBootstrap, type OperatorPlatformBootstrapFleetRequest, type OperatorPlatformBootstrapFleetResult } from './operator-bootstrap';
import type { PlatformBootstrapSecrets } from './bootstrap';
export interface AttendedPlatformBootstrapResult {
    kind: 'forgezero-attended-platform-bootstrap';
    ok: boolean;
    edge: CloudflareBootstrapEvidence;
    fleet: OperatorPlatformBootstrapFleetResult;
    acceptance?: CloudflareBootstrapAcceptanceEvidence;
    invitationHandoffFile?: string;
}
/**
 * Owner-only final bootstrap capability.
 *
 * The URL is a one-use credential, not ordinary CLI output. It exists only in
 * this exclusive 0600 artifact after public ingress and claimability have both
 * been verified. Callers may disclose it to the owner only after the complete
 * release gate has passed.
 */
export interface InvitationHandoff {
    format: 1;
    kind: 'forgezero-invitation-handoff';
    apiOrigin: string;
    appOrigin: string;
    inviteUrl: string;
    claimable: true;
    verifiedAt: string;
}
/** Atomically refresh an owner-only handoff while refusing unsafe existing paths. */
export declare function writeInvitationHandoff(path: string, handoff: InvitationHandoff): string;
export interface AttendedPlatformBootstrapDependencies {
    cloudflare?: typeof runAttendedCloudflareBootstrap;
    fleet?: typeof applyOperatorPlatformFleetBootstrap;
    validateInvite?: typeof validatePlatformInvitation;
    finalize?: typeof finalizeCloudflareBootstrapAcceptance;
}
export declare function validatePlatformInvitation(args: {
    apiOrigin: string;
    inviteUrl: string;
    fetcher?: typeof fetch;
}): Promise<void>;
/**
 * The sole attended genesis composition boundary. All non-secret coordinates
 * are checked before the first Cloudflare or SSH mutation. Secret values exist
 * only in this call and the authenticated SSH stdin used by the fleet runner.
 */
export declare function applyAttendedPlatformBootstrap(fleetRequest: OperatorPlatformBootstrapFleetRequest, cloudflareRequest: AttendedCloudflareBootstrapRequest, acceptancePath: string, secrets: PlatformBootstrapSecrets, dependencies?: AttendedPlatformBootstrapDependencies): Promise<AttendedPlatformBootstrapResult>;