import { type Capabilities, type CapabilityOperation, type ProvisionOperation, type ProvisionPlan } from '../provision';
/**
 * `fz agent install` — run the provision plan on THIS machine.
 *
 * The plan itself is the agent's public `provision` subpath, with no transport, and
 * that is the whole point: the platform runs the same steps over SSH when it
 * enrols a compute. This file is the local executor and nothing else — it
 * decides how to run a command here, never what the commands are.
 *
 * It was briefly the other thing. This module had its own machine detection
 * calling `existsSync` directly and its own unit renderer, while the API had a
 * `Check`-based preflight designed to run remotely. Two answers to "is this box
 * ready" is one answer nobody can trust, and the local one drifts first because
 * it is the one somebody runs while debugging.
 */
export type { ProvisionPlan };
/** Normalize ssh-keygen -y output while validating the exact Ed25519 wire blob. */
export declare function normalizeEd25519PublicKey(output: string): string | undefined;
/** Parse NAME=value pairs used only for non-secret unit coordinates and credential paths. */
export declare function parseAssignments(value: string | undefined): Record<string, string> | undefined;
/** Parse an explicit provisioning-owned TCP allowlist; repository data never reaches this input. */
export declare function parseTcpPorts(value: string | undefined): readonly number[] | undefined;
/**
 * Answer the capability checks by running their commands.
 *
 * Running the command rather than calling `existsSync` is deliberate even
 * though this is the local path: it means the answer here and the answer over
 * SSH come from the same test, so a box that reports `attested` to an operator
 * cannot report `enrolled` to the platform.
 */
export declare function readCapabilities(run: (operation: CapabilityOperation) => Promise<{
    stdout: string;
    exitCode: number;
}>): Promise<Capabilities>;
export declare function localRunner(operation: CapabilityOperation | ProvisionOperation): Promise<{
    stdout: string;
    exitCode: number;
}>;
export interface InstallOptions {
    capabilities: Capabilities;
    socketPath: string;
    seedPath: string;
    seedCredentialPath?: string;
    gitCredentialPath?: string;
    gitPublicKeyPath?: string;
    generateGitIdentity?: boolean;
    controlSocketPath?: string;
    repository?: string;
    branch?: string;
    bootstrapBundlePath?: string;
    bootstrapBundleManifestPath?: string;
    bootstrapDeploymentIntent?: import('../bootstrap-deployment-intent').BootstrapDeploymentIntent;
    profile?: string;
    deployRoot?: string;
    deploymentKey?: string;
    publicApiUrl?: string;
    platformSecretAuthorityState?: 'bootstrap' | 'activating' | 'managed' | 'recovery';
    deploymentEnvironment?: Record<string, string>;
    deploymentCredentials?: Record<string, string>;
    pullDeployments?: boolean;
    enforceEgress?: boolean;
    egressPrerequisitesReady?: boolean;
    runnerLoopbackPorts?: readonly number[];
    agentLoopbackPorts?: readonly number[];
    runnerPublicTcpPorts?: readonly number[];
    pullMigrations?: boolean;
    pullBootstrap?: boolean;
    bootstrapSshCredentialPath?: string;
    bootstrapSshSourcePath?: string;
    bootstrapSshPublicKeyPath?: string;
    bootstrapTargetTelemetryEndpoint?: string;
    lifecycleProfilePath?: string;
    lifecycleHelperSocketPath?: string;
    warpOrganization?: string;
    warpClientIdCredentialPath?: string;
    warpClientSecretCredentialPath?: string;
    cloudflareAccountId?: string;
    cloudflareTunnelId?: string;
    cloudflareVirtualNetworkId?: string;
    cloudflareWarpPolicyId?: string;
    binPath?: string;
    sourceBinPath?: string;
    user?: string;
    apiUrl?: string;
    project?: string;
    environment?: string;
    enrolTokenSourcePath?: string;
    enrolTokenCredentialPath?: string;
    enrolStatePath?: string;
    nodeLabel?: string;
    nodeHostname?: string;
    telemetryEndpoint?: string;
}
export type GitIdentityInstallOptions = Pick<InstallOptions, 'gitCredentialPath' | 'gitPublicKeyPath' | 'generateGitIdentity'>;
/**
 * Resolve the optional compatibility Git identity from the explicit install
 * environment. An ordinary Agent install must not load a credential merely
 * because the CLI knows its conventional pathname: systemd treats every
 * LoadCredentialEncrypted entry as required and refuses to start when that
 * file does not exist.
 */
export declare function resolveGitIdentityInstallOptions(environment: Readonly<Record<string, string | undefined>>): GitIdentityInstallOptions;
export declare function planInstall(options: InstallOptions): ProvisionPlan;
/** Execute the same ordered plan the control plane executes over SSH. */
export declare function applyPlan(plan: ProvisionPlan, run: (operation: CapabilityOperation | ProvisionOperation) => Promise<{
    stdout: string;
    exitCode: number;
}>): Promise<readonly {
    label: string;
    command: string;
    exitCode: number;
}[]>;
/**
 * What a reader needs to see before running any of it.
 *
 * Printed rather than executed by default. Installing a system service that
 * holds key material should not happen because somebody typed a subcommand, and
 * an operator who reads the unit first is one who can notice it is about to run
 * as the wrong user.
 */
export declare function renderPlan(plan: ProvisionPlan): string;