export interface CloudflareEdgeConfig {
    accountId: string;
    zoneId: string;
    tunnelId: string;
    hostname: string;
    service: string;
    /** The single attended management capability used for both Tunnel and DNS writes. */
    apiToken: string;
}
export interface CloudflareBootstrapDiscovery {
    accountId: string;
    zoneId: string;
    kvNamespaceId: string;
}
/**
 * Resolve stable Cloudflare ids from owner-recognizable names without ever
 * persisting or printing either token. The management token is used only for
 * the exact zone lookup; the runtime token is used only for the existing KV
 * namespace and optional Worker/DO ownership proof.
 */
export declare function discoverCloudflareBootstrapResources(config: {
    zoneName: string;
    kvNamespaceTitle: string;
    workerScriptName?: string;
    tunnelToken: string;
    apiToken: string;
}, fetcher?: typeof fetch): Promise<CloudflareBootstrapDiscovery>;
export interface CloudflarePrivateRouteConfig {
    accountId: string;
    tunnelId: string;
    network: string;
    virtualNetworkId?: string;
    comment: string;
    apiToken: string;
}
export interface CloudflarePrivateRoute {
    id: string;
    network: string;
    tunnel_id: string;
    virtual_network_id?: string;
    comment?: string;
    deleted_at?: string | null;
}
/**
 * Idempotently advertise a private CIDR through a Tunnel.
 *
 * This is Cloudflare One routing only: it creates no DNS record and therefore
 * cannot accidentally turn a database address into a public hostname.
 */
export declare function ensureCloudflarePrivateRoute(config: CloudflarePrivateRouteConfig, fetcher?: typeof fetch): Promise<{
    route: CloudflarePrivateRoute;
    created: boolean;
}>;
/**
 * Advertise exactly one database member, never its surrounding subnet. The
 * caller still selects a VNET when private ranges overlap between sites.
 */
export declare function ensureCloudflarePrivateDatabaseRoute(config: Omit<CloudflarePrivateRouteConfig, 'network'> & {
    privateAddress: string;
}, fetcher?: typeof fetch): Promise<{
    route: CloudflarePrivateRoute;
    created: boolean;
}>;
/**
 * Remove one private route only while it is still owned by the expected
 * Tunnel/VNET. Migration cleanup must never delete a route that another
 * controller has deliberately reassigned since this operation was planned.
 */
export declare function removeCloudflarePrivateRoute(config: Pick<CloudflarePrivateRouteConfig, 'accountId' | 'tunnelId' | 'network' | 'virtualNetworkId' | 'apiToken'>, fetcher?: typeof fetch): Promise<{
    removed: boolean;
    route?: CloudflarePrivateRoute;
}>;
export declare function removeCloudflarePrivateDatabaseRoute(config: Omit<CloudflarePrivateRouteConfig, 'network' | 'comment'> & {
    privateAddress: string;
}, fetcher?: typeof fetch): Promise<{
    removed: boolean;
    route?: CloudflarePrivateRoute;
}>;
export interface CloudflareWarpIncludeConfig {
    accountId: string;
    /** Omit only when the account default device profile is intentionally dedicated to ForgeZero computes. */
    policyId?: string;
    privateAddress: string;
    description: string;
    apiToken: string;
}
interface CloudflareSplitTunnelEntry {
    address?: string;
    host?: string;
    description?: string;
}
/**
 * Reconcile the exact private networks that Mesh nodes must send through
 * Cloudflare. Existing profile entries are preserved; only ForgeZero-owned
 * descriptions are added. The caller must use a dedicated Mesh device profile.
 */
export declare function ensureCloudflareWarpNetworkIncludes(config: {
    accountId: string;
    policyId: string;
    networks: readonly string[];
    descriptionPrefix: string;
    apiToken: string;
}, fetcher?: typeof fetch): Promise<{
    entries: readonly CloudflareSplitTunnelEntry[];
    created: number;
}>;
/** Preserve the profile's existing entries while including one exact database host route. */
export declare function ensureCloudflareWarpDatabaseInclude(config: CloudflareWarpIncludeConfig, fetcher?: typeof fetch): Promise<{
    entries: readonly CloudflareSplitTunnelEntry[];
    created: boolean;
}>;
/** Remove only one exact host include and preserve the rest of the profile. */
export declare function removeCloudflareWarpDatabaseInclude(config: Omit<CloudflareWarpIncludeConfig, 'description'>, fetcher?: typeof fetch): Promise<{
    entries: readonly CloudflareSplitTunnelEntry[];
    removed: boolean;
}>;
/** Reconcile one remotely-managed tunnel route and its proxied DNS record. */
export declare function configureCloudflareEdge(config: CloudflareEdgeConfig, fetcher?: typeof fetch): Promise<void>;
export interface CloudflareTunnel {
    id: string;
    name: string;
    status?: string;
    deleted_at?: string | null;
}
export interface CloudflareMeshConnector {
    id: string;
    name: string;
    status?: 'inactive' | 'degraded' | 'healthy' | 'down';
    tun_type?: 'warp_connector';
    deleted_at?: string | null;
}
export interface CloudflareDurableObjectNamespace {
    id?: string;
    name?: string;
    class?: string;
    script?: string;
    use_sqlite?: boolean;
}
/**
 * Prove that the separately deployed Worker already owns at least one Durable
 * Object namespace. ForgeZero does not deploy or alter the Worker here; this is
 * a read-only control-plane check before installing shared application secrets.
 */
export declare function verifyCloudflareWorkerDurableObjects(config: {
    accountId: string;
    scriptName: string;
    apiToken: string;
}, fetcher?: typeof fetch): Promise<readonly CloudflareDurableObjectNamespace[]>;
/** Install the compatibility pair plus the v3 producer trust and edge identity. */
export declare function configureCloudflareRealtimeSecrets(config: {
    accountId: string;
    scriptName: string;
    publishSecret: string;
    ticketSecret: string;
    producerPublicKeys: Record<string, {
        ed25519: string;
        mlDsa: string;
    }>;
    edgeIdentity: {
        nodeKey: string;
        seed: string;
    };
    apiToken: string;
}, fetcher?: typeof fetch): Promise<void>;
/**
 * Create or adopt one Cloudflare Mesh node (the current WARP Connector
 * product name) and retrieve the node-registration token. This is the
 * bidirectional L3/L4 boundary for metal-to-metal traffic; it is deliberately
 * separate from the public, inbound-only cloudflared Tunnel.
 */
export declare function ensureCloudflareMeshConnector(config: {
    accountId: string;
    name: string;
    highAvailability: boolean;
    apiToken: string;
}, fetcher?: typeof fetch): Promise<{
    connector: CloudflareMeshConnector;
    connectorToken: string;
    created: boolean;
}>;
/**
 * Create or reuse one remotely-managed Tunnel and obtain its connector token.
 * The token is returned once to the caller so it can be PQ-delivered to the
 * Agent and sealed as a systemd credential; it is never persisted in ArangoDB.
 */
export declare function ensureCloudflareTunnel(config: {
    accountId: string;
    name: string;
    apiToken: string;
}, fetcher?: typeof fetch): Promise<{
    tunnel: CloudflareTunnel;
    connectorToken: string;
    created: boolean;
}>;
/** Retrieve node-scoped connector capabilities only in the target Agent process. */
export declare function retrieveCloudflareConnectorTokens(config: {
    accountId: string;
    tunnelId: string;
    meshConnectorId?: string;
    apiToken: string;
}, fetcher?: typeof fetch): Promise<{
    connectorToken: string;
    meshConnectorToken?: string;
}>;
export {};