import { type ProvisionPlan } from './cli/agent-install';
import { type Capabilities } from './provision';
import { type SoftwareCommandResult, type SoftwareRequirement } from './software';
import { type PlatformSharedEnvironment } from './platform-bootstrap-runtime';
import { type BootstrapBundleManifest } from './bootstrap-bundle';
export declare const PLATFORM_BOOTSTRAP_PROFILES: readonly ["platform-db-api", "platform-api"];
export type PlatformBootstrapProfile = (typeof PLATFORM_BOOTSTRAP_PROFILES)[number];
export type DatabaseBootstrapRole = 'master' | 'joiner' | 'none';
export type DatabaseAgencyParticipation = 'member' | 'none';
export type PlatformEnrolmentSource = 'genesis-derived' | 'api-token';
export type BootstrapEnvironment = 'production' | 'development';
export interface PlatformBootstrapConfig {
    kind: 'platform';
    environment: BootstrapEnvironment;
    profile: PlatformBootstrapProfile;
    /** API-owned compute reference. Initial seed references come from the reviewed generic guest requests. */
    computeReference: string;
    nodeHostname: string;
    apiUrl: string;
    /** One attended local source used only for release generation one. */
    bootstrapBundle: {
        bundleFile: string;
        manifestFile: string;
        branch: string;
    };
    deployRoot?: string;
    telemetryEndpoint: string;
    /**
     * Pipeline secret name -> encrypted systemd bootstrap credential source.
     * Usable only while the platform authority is `bootstrap` or `activating`;
     * managed runtime removes these broad credentials after Vault verification.
     */
    deploymentCredentials?: Record<string, string>;
    database: {
        role: DatabaseBootstrapRole;
        /** Genesis master/joiners are Agency members; elastic joiners normally use `none`. */
        agency: DatabaseAgencyParticipation;
        /** Prefer this normal writable Coordinator only for explicitly read-safe operations. */
        readPreferred?: boolean;
        /** Cluster mode must remain default. Bootstrap verifies it and never mutates it. */
        serverMode: 'default';
        address?: string;
        master?: string;
        coordinators: string[];
    };
    /** Explicit authority source; never inferred from a node number. */
    enrolment: {
        source: PlatformEnrolmentSource;
    };
    runtime: {
        environment: PlatformSharedEnvironment;
        serviceUser: string;
        slotsDirectory: string;
        bluePort: number;
        greenPort: number;
        healthPath: string;
        keepReleases: number;
    };
    firewall: {
        enabled: boolean;
        sshPort: number;
        privateCidrs: string[];
    };
    /** Install and configure public ingress from a node-specific attended handoff. */
    installCloudflared?: boolean;
    /** Install Cloudflare Mesh/WARP only when the handoff contains a Mesh connector. */
    installWarp?: boolean;
    /** Node-specific attended handoff; a host must never receive the fleet checkpoint. */
    cloudflareHandoff?: {
        handoffFile: string;
        nodeName: string;
    };
}
export interface EnrolledComputeActivationConfig {
    kind: 'enrolled-compute';
    operatingSystem: {
        id: 'ubuntu';
        version: '24.04' | '26.04';
        architecture: 'x64';
    };
    apiUrl: string;
    realm: string;
    nodeHostname: string;
    telemetryEndpoint: string;
    /** Rejected for tenant computes. Deployment credentials come from assigned Vault entries. */
    deploymentCredentials?: Record<string, string>;
    repository?: string;
    branch?: string;
    profile?: string;
    deployRoot?: string;
    software?: SoftwareRequirement[];
    /** Compatibility-only per-node SSH deploy key for non-provider sources. */
    gitDeployKey?: boolean;
    installCloudflared?: boolean;
    installWarp?: boolean;
    /** Optional node-specific attended Tunnel/KV/Mesh handoff, identical to platform hosts. */
    cloudflareHandoff?: {
        handoffFile: string;
        nodeName: string;
    };
    /** Local-only runner authority. The API receives only the resulting node scope. */
    bootstrapRunner?: {
        /** Optional imported key; omit to generate a unique runner key on this host. */
        sshPrivateKeyFile?: string;
        targetTelemetryEndpoint: string;
    };
}
export type BootstrapConfig = PlatformBootstrapConfig | EnrolledComputeActivationConfig;
/** Ephemeral values accepted only from hidden input and sealed on the target. */
export interface PlatformBootstrapSecrets {
    clusterBootstrapCode: string;
    emailSecret: string;
    /** Required only for an API-issued post-genesis capability. */
    enrolmentToken?: string;
    backupS3Secret?: string;
    cloudflareTunnelToken?: string;
    cloudflareApiToken?: string;
}
export interface EnrolledComputeBootstrapSecrets {
    enrolmentToken: string;
    cloudflareTunnelToken?: string;
    cloudflareApiToken?: string;
}
export type BootstrapSecrets = PlatformBootstrapSecrets | EnrolledComputeBootstrapSecrets;
export declare function validateEnrolledComputeBootstrapSecrets(config: EnrolledComputeActivationConfig, input: unknown): EnrolledComputeBootstrapSecrets;
export declare function validatePlatformBootstrapSecrets(config: PlatformBootstrapConfig, input: unknown, options?: {
    allowStoredCloudflareCredentials?: boolean;
}): PlatformBootstrapSecrets;
export interface BootstrapStep {
    id: string;
    label: string;
    mutation: boolean;
}
export interface BootstrapPlan {
    kind: BootstrapConfig['kind'];
    mode: 'install' | 'repair';
    profile: string;
    steps: readonly BootstrapStep[];
    software: readonly SoftwareRequirement[];
    statePath: string;
}
export interface BootstrapResult {
    plan: BootstrapPlan;
    applied: boolean;
    status: BootstrapStatus;
    launch?: {
        executable: '/usr/local/bin/fz';
        argv: readonly string[];
        environment: {
            FZ_SHARED_DIR: string;
        };
        runAs: string;
        inviteUrl: string;
    };
}
export interface BootstrapStatus {
    initialized: boolean;
    kind?: BootstrapConfig['kind'];
    profile?: string;
    services: Record<string, boolean>;
    problems: string[];
}
export type InstalledBootstrapKind = 'compute' | 'metal';
export type BootstrapAgentInstallPhase = 'bootstrap' | 'promote' | 'enrol' | 'bound';
/** One host has one bootstrap authority. Dual state is never resolved by precedence. */
export declare function resolveInstalledBootstrapKind(states: {
    compute: boolean;
    metal: boolean;
}): InstalledBootstrapKind | undefined;
export interface BootstrapHost {
    uid(): number;
    exists(path: string): boolean;
    read(path: string): string;
    write(path: string, content: string, mode: number): void;
    mkdir(path: string, mode: number): void;
    remove(path: string): void;
    inspect?(path: string): {
        regular: boolean;
        symbolic: boolean;
        uid: number;
        mode: number;
        links: number;
        size: number;
    };
    exec(argv: readonly string[], options?: {
        stdin?: string;
    }): Promise<SoftwareCommandResult>;
    sleep?(milliseconds: number): Promise<void>;
    ensureSoftware(requirements: readonly SoftwareRequirement[]): Promise<unknown>;
    installAgent(config: BootstrapConfig, phase: BootstrapAgentInstallPhase): Promise<ProvisionPlan>;
}
export interface BootstrapExecutionEvent {
    format: 1;
    operationId: string;
    sequence: number;
    computeReference: string;
    nodeHostname: string;
    timestamp: string;
    stage: 'bootstrap' | 'command' | 'software' | 'agent';
    status: 'started' | 'succeeded' | 'nonzero' | 'failed';
    command?: string[];
    exitCode?: number;
    durationMs?: number;
    safeDetail?: string;
}
export declare const BOOTSTRAP_STATE_PATH = "/var/lib/forgezero/bootstrap.json";
interface BootstrapDependencies {
    fetcher?: typeof fetch;
    reuseBoundPlatformCredentials?: boolean;
    onProgress?: (event: BootstrapExecutionEvent) => void;
}
export declare function validateBootstrapConfig(value: BootstrapConfig): BootstrapConfig;
export declare function planBootstrap(input: BootstrapConfig, initialized?: boolean): BootstrapPlan;
export declare function bootstrapIdentityDigest(config: BootstrapConfig): string;
export declare const legacyBootstrapIdentityDigest: (config: BootstrapConfig) => string;
/**
 * Exact, reviewed identity migrations for an already-installed platform host.
 * This is deliberately not a generic "stored coordinates match" escape hatch:
 * only the development collector transition, reviewed genesis evidence, and
 * narrowly identified bootstrap-schema repairs are accepted.
 */
export declare function approvedPlatformRepairIdentityDigests(config: PlatformBootstrapConfig): readonly string[];
/** Exact prior-release identities accepted only while generation one is still unenrolled. */
export declare function interruptedPlatformReleaseIdentityDigests(config: PlatformBootstrapConfig, releaseEvidence: {
    revision: string;
    sha256: string;
    branch: string;
}, bootstrapManifest?: BootstrapBundleManifest): readonly string[];
export declare function bootstrapStatus(host?: BootstrapHost): Promise<BootstrapStatus>;
export declare function applyBootstrap(input: BootstrapConfig, host?: BootstrapHost, secrets?: BootstrapSecrets, dependencies?: BootstrapDependencies): Promise<BootstrapResult>;
export declare function readBootstrapConfig(path: string): BootstrapConfig;
interface BootstrapAgentInitialBundle {
    path: string;
    manifestPath: string;
    manifest: BootstrapBundleManifest;
}
/** Compose one real local Agent convergence without consulting mutable globals. */
export declare function planBootstrapAgentInstall(config: BootstrapConfig, phase: BootstrapAgentInstallPhase, context: {
    capabilities: Capabilities;
    hasBinding: boolean;
    hasEnrolCredential: boolean;
    initialBundle?: BootstrapAgentInitialBundle;
}): ProvisionPlan;
export declare function localBootstrapHost(): BootstrapHost;
export {};