export interface CloudflareMeshCoordinates {
    /** Unique account-scoped Mesh/WARP Connector name. */
    connectorName: string;
    /** Exact private CIDRs reachable behind this metal/compute. */
    routes: string[];
    /** Mesh replicas sharing one connector may be active/passive. */
    highAvailability?: boolean;
}
export interface CloudflareBootstrapNodeCoordinates {
    nodeName: string;
    hostname: string;
    service: string;
    tunnelName: string;
    /** Optional bidirectional private networking, independent of public ingress. */
    mesh?: CloudflareMeshCoordinates;
}
export interface CloudflareRealtimeCoordinates {
    /** Existing Worker script deployed independently through Cloudflare Git integration. */
    workerScriptName: string;
    /** Stable public HTTPS Worker origin used by API publishers and WebSocket clients. */
    endpoint: string;
    /** Signed producer identity emitted by this platform API fleet. */
    producer: string;
}
export interface CloudflareBootstrapCoordinates {
    accountId: string;
    zoneId: string;
    /** Existing namespace bound to the separately deployed Worker. */
    kvNamespaceId: string;
    /** Existing dedicated Mesh device profile whose include list ForgeZero owns. */
    meshDevicePolicyId?: string;
    /** Optional existing Worker/DO realtime boundary. No Worker source is deployed here. */
    realtime?: CloudflareRealtimeCoordinates;
    nodes: CloudflareBootstrapNodeCoordinates[];
}
export interface CloudflareBootstrapTokens {
    tunnelToken: string;
    apiToken: string;
}
interface CloudflareBootstrapNodeResource extends CloudflareBootstrapNodeCoordinates {
    tunnelId: string;
    mesh?: CloudflareMeshCoordinates & {
        connectorId: string;
    };
}
interface CloudflareBootstrapResources {
    kvNamespaceId: string;
    nodes: CloudflareBootstrapNodeResource[];
}
export interface CloudflareBootstrapOutput {
    format: 1;
    kind: 'forgezero-cloudflare-bootstrap';
    phase: 'edge-resources-provisioned' | 'complete';
    updatedAt: string;
    coordinates: CloudflareBootstrapCoordinates;
    resources: CloudflareBootstrapResources;
    created?: {
        nodes: Array<{
            nodeName: string;
            tunnel: boolean;
            mesh: boolean;
        }>;
    };
}
export interface CloudflareBootstrapPlan {
    format: 1;
    kind: 'forgezero-cloudflare-bootstrap-plan';
    mode: 'attended-hidden-input';
    outputFile: string;
    coordinates: CloudflareBootstrapCoordinates;
    operations: readonly string[];
    secrets: readonly string[];
}
export interface AttendedCloudflareBootstrapRequest {
    mode: 'plan' | 'apply';
    coordinates: CloudflareBootstrapCoordinates;
    tokens?: CloudflareBootstrapTokens;
    checkpointPath: string;
}
/** Secret-free evidence safe to embed in the platform bootstrap journal. */
export interface CloudflareBootstrapEvidence {
    format: 1;
    kind: 'forgezero-cloudflare-bootstrap-evidence';
    phase: 'planned' | 'complete';
    checkpointFile: string;
    kvNamespaceId?: string;
    nodes: ReadonlyArray<{
        nodeName: string;
        hostname: string;
        handoffFile?: string;
        tunnelId?: string;
    }>;
}
export interface CloudflareBootstrapAcceptanceEvidence {
    format: 1;
    kind: 'forgezero-cloudflare-bootstrap-acceptance';
    checkpointFile: string;
    verifiedAt: string;
    nodes: ReadonlyArray<{
        nodeName: string;
        hostname: string;
        status: number;
    }>;
}
export interface CloudflareBootstrapAcceptedNode {
    nodeName: string;
    hostname: string;
}
export interface CloudflareBootstrapFinalizeRequest {
    checkpointPath: string;
    acceptancePath: string;
}
export interface CloudflareBootstrapDependencies {
    fetcher?: typeof fetch;
}
export type CloudflareBootstrapPhaseRunner = (request: AttendedCloudflareBootstrapRequest) => Promise<CloudflareBootstrapEvidence>;
export declare function validateCloudflareBootstrapTokens(input: unknown): CloudflareBootstrapTokens;
export interface CloudflareBootstrapTopology {
    meshDevicePolicyId?: string;
    realtime?: CloudflareRealtimeCoordinates;
    nodes: CloudflareBootstrapNodeCoordinates[];
}
/** Validate the fleet/realtime shape without inventing resource identifiers. */
export declare function validateCloudflareBootstrapTopology(input: CloudflareBootstrapTopology): CloudflareBootstrapTopology;
export declare function validateCloudflareBootstrapCoordinates(input: CloudflareBootstrapCoordinates): CloudflareBootstrapCoordinates;
export declare function planCloudflareBootstrap(input: CloudflareBootstrapCoordinates, outputPath: string): CloudflareBootstrapPlan;
export interface CloudflareConnectorHandoff {
    nodeName: string;
    hostname: string;
    service: string;
    tunnelId: string;
    mesh?: {
        connectorId: string;
        routes: readonly string[];
    };
}
export interface CloudflareHostHandoff extends CloudflareConnectorHandoff {
    accountId: string;
    zoneId: string;
    kvNamespaceId: string;
    realtime?: CloudflareRealtimeCoordinates;
}
export declare function cloudflareHostHandoffPath(checkpointPath: string, nodeName: string): string;
export declare function readCloudflareConnectorHandoff(checkpointPath: string, nodeName: string): Promise<CloudflareConnectorHandoff>;
export declare function readCloudflareHostHandoff(handoffPath: string, nodeName: string): Promise<CloudflareHostHandoff>;
export declare function writeOwnerBootstrapOutput(path: string, output: CloudflareBootstrapOutput): Promise<void>;
export declare const deriveCloudflareRealtimeSecrets: (apiToken: string, producer?: string) => {
    publishSecret: string;
    ticketSecret: string;
    producerIdentity: {
        nodeKey: string;
        keys: import("@forgezero/runtime/identity").NodeKeyPair;
    };
    producerPublicKeys: {
        [x: string]: {
            ed25519: string;
            mlDsa: string;
        };
    };
    edgeIdentity: {
        nodeKey: string;
        seed: string;
    };
    edgePublicKeys: {
        ed25519: string;
        mlDsa: string;
    };
};
/** Attended, resumable Tunnel/DNS/KV handoff bootstrap. */
export declare function applyCloudflareBootstrap(input: CloudflareBootstrapCoordinates, tokens: CloudflareBootstrapTokens, outputPath: string, fetcher?: typeof fetch): Promise<CloudflareBootstrapOutput>;
export declare function runAttendedCloudflareBootstrap(request: AttendedCloudflareBootstrapRequest, dependencies?: CloudflareBootstrapDependencies): Promise<CloudflareBootstrapEvidence>;
export declare function verifyCloudflareBootstrapAcceptance(checkpointPath: string, fetcher?: typeof fetch): Promise<CloudflareBootstrapAcceptanceEvidence>;
/**
 * Read finalized, secret-free Cloudflare acceptance after the working
 * checkpoint has been removed. This is the durable input consumed by the fleet
 * rehearsal; it never attempts to reopen the deleted handoff.
 */
export declare function readCloudflareBootstrapAcceptanceEvidence(acceptancePath: string, expectedNodes?: readonly CloudflareBootstrapAcceptedNode[]): Promise<CloudflareBootstrapAcceptanceEvidence>;
/**
 * Prove every public node, persist secret-free acceptance evidence, then remove
 * the resumable secret-free checkpoint and node handoffs.
 */
export declare function finalizeCloudflareBootstrapAcceptance(request: CloudflareBootstrapFinalizeRequest, fetcher?: typeof fetch): Promise<CloudflareBootstrapAcceptanceEvidence>;
export {};