import { type DrainReport, type QueueTask } from '@forgezero/runtime/queue';
import { type GitHostResolver } from './git-egress';
import { type ManagedSoftwareEvidence, type SoftwareRequirement } from './software';
import type { NativeApplicationActivationRequest, ServiceActivationState } from './service-supervisor';
import type { ReleaseEvidence } from './deployment-evidence';
import type { ContainerActivateRequest, ContainerBuildRequest, ContainerBuildResult } from './container-supervisor';
import { type RunResult } from './pipeline';
import type { SecretCache } from './cache';
import type { DeploymentVaultBindingsV3 } from '@forgezero/access/vault';
import type { AttestationSource } from './socket';
import { type CapacityCalibration, type CapacityCalibrationOptions } from './capacity-calibration';
import { type BootstrapBundleManifest } from './bootstrap-bundle';
import type { DeploymentConnectivityCapabilities, DeploymentConnectivityEvidence, DeploymentConnectivityIntent, DeploymentConnectivityRequest } from './deployment-connectivity';
import type { StandaloneDatabaseActivationEvidence, StandaloneDatabaseActivationRequest } from './database-supervisor';
/** Bind one SNP report to the exact deployed commit with a 32-byte challenge. */
export declare const deploymentAttestationChallenge: (revision: string) => string;
export interface CommandInput {
    argv: readonly string[];
    cwd?: string;
    env?: Record<string, string>;
    timeoutMs?: number;
}
export interface CommandResult {
    exitCode: number;
    output: string;
}
export interface DeploymentRequest {
    /** Optional exact commit from a verified webhook. Never a branch name. */
    revision?: string;
    /** Optional hash from the control-plane's prior inspection. A differing
     * checked-in plan fails before any workflow action can run. */
    expectedDefinitionDigest?: string;
    /** True only for the target deterministically elected for release-scoped steps. */
    releaseExecutor?: boolean;
    /** Exact control-plane placement for this compute. Absence is allowed only for one unambiguous bootstrap target. */
    assignment?: {
        targetName: string;
        slot: number;
        definitionDigest: string;
        operatingSystem: ResolvedDeploymentTarget['operatingSystem'];
        confidentialCompute: ResolvedDeploymentTarget['confidentialCompute'];
        execution: ResolvedDeploymentTarget['allocation']['execution'];
        sharing: ResolvedDeploymentTarget['allocation']['sharing'];
        resources: ResolvedDeploymentTarget['allocation']['resources'];
        connectivity?: DeploymentConnectivityIntent;
        firewallPolicy?: import('./deployment-connectivity').DeploymentFirewallPolicy;
        topology?: {
            site: string;
            nodeIdentity: string;
            role: 'relay' | 'standby' | 'member';
            transport: 'private-lan' | 'cloudflare-warp';
            siteCidr: string;
            localRelayReference: string;
            localRelayAddress: string;
            localPeerAddresses: readonly string[];
            localPeerIdentities: readonly string[];
            remoteRelayAddresses: readonly string[];
            remoteRelayIdentities: readonly string[];
            remoteMemberAddresses: readonly string[];
            remoteSiteCidrs: readonly string[];
            memberIdentities: readonly string[];
            healthPort: number;
            routedTcpPorts: readonly number[];
            warpRequired: boolean;
            generation: string;
        };
    };
    /** Connector-scoped, one-claim capabilities. Never the project Cloudflare management token. */
    connectivityCapabilities?: DeploymentConnectivityCapabilities;
    /** Exact V3 Vault bindings sealed into one native release claim. */
    vaultBindings?: DeploymentVaultBindingsV3;
    /** Claim-fenced control-plane progress sink; receives only redacted evidence. */
    onProgress?: (execution: DeploymentExecution) => Promise<void>;
}
export interface DeploymentResult {
    key: string;
    repository: string;
    branch: string;
    revision: string;
    /** Semantic digest of the validated definition from this exact commit. */
    definitionDigest: string;
    definitionVersion: number;
    profile: string;
    /** Resolved only from the validated plan and its bounded inputs at this revision. */
    resolvedTargets?: readonly ResolvedDeploymentTarget[];
    /** Exact distinct catalogue entries successfully managed on this compute. */
    managedSoftware: readonly ManagedSoftwareEvidence[];
    /** Derived compatibility count; managedSoftware remains authoritative. */
    paidManagedSoftwareCount: number;
    release: string;
    ok: boolean;
    phases: readonly RunResult[];
    /** Bounded, credential-redacted execution evidence suitable for control-plane history. */
    execution: DeploymentExecution;
    /** Exact artifact, plan and real slot-transition proof for this terminal release. */
    releaseEvidence: ReleaseEvidence;
    capacity?: CapacityCalibration & {
        evidencePath: string;
        recommendedCoordinate: {
            FZ_REQUESTS_PER_SECOND_LIMIT: string;
            FZ_CONCURRENCY_LIMIT: string;
        };
    };
}
export interface DeploymentExecutionStep {
    phase: string;
    step: string;
    outcome: 'ok' | 'failed' | 'skipped';
    exitCode: number | null;
    durationMs: number;
    /** Present only for a failed step; known injected credentials are redacted first. */
    detail?: string;
}
export interface DeploymentExecution {
    steps: readonly DeploymentExecutionStep[];
}
export interface ResolvedDeploymentTarget {
    name: string;
    profiles: readonly string[];
    operatingSystem: {
        id: 'ubuntu';
        version: '24.04' | '26.04';
        architecture: 'x64';
    };
    confidentialCompute: 'required' | 'preferred' | 'disabled';
    labels: Readonly<Record<string, string>>;
    minimum: number;
    desired: number;
    maximum: number;
    allocation: {
        execution: 'native' | 'oci-runc' | 'oci-kata-qemu-snp';
        sharing: 'exclusive' | 'shared';
        resources: {
            cpuCores: number;
            memoryMiB: number;
            storageGiB: number;
        };
        existing: 'prefer' | 'require';
    };
    provisioning?: {
        regionKey: string;
        imageKey: string;
        environmentKey: string;
        ownership: 'platform' | 'tenant-metal';
        metalHostname?: string;
        resources: {
            physicalCores: number;
            vcpu: number;
            memoryGib: number;
            diskGib: number;
            diskEncryption?: 'none' | 'luks2';
            egressGuaranteedMbps: number;
            egressBurstMbps: number;
            confidential: boolean;
        };
        monthlyAmountCents: string;
        maxMonthlySpendMinor: string;
    };
    connectivity?: {
        private?: {
            mode: 'disabled' | 'private-lan';
        } | {
            mode: 'cloudflare-warp';
            credential: string;
            network: string;
        };
        public?: {
            mode: 'disabled';
        } | {
            mode: 'cloudflare-tunnel';
            credential: string;
            zone: string;
            hostname: {
                mode: 'static';
                label: string;
            } | {
                mode: 'indexed';
                prefix: string;
                startAt: number;
            };
            service: {
                protocol: 'http';
                port: number;
            };
        };
    };
    topology?: {
        groupBy: 'metal';
        relays: {
            activePerMetal: 1;
            standbyPerMetal: 0 | 1;
            healthPort: number;
            routedTcpPorts: readonly number[];
        };
        crossMetal: {
            mode: 'private-lan';
        } | {
            mode: 'cloudflare-warp';
            credential: string;
            network: string;
        } | {
            mode: 'auto';
            directPrivateMaximumMetals: 2;
            credential: string;
            network: string;
        };
    };
}
/**
 * How the credential-bearing agent may read one server-owned Git source.
 * Secret values never appear in a deployment claim or checked-in pipeline.
 */
export type GitSourceAuth = {
    kind: 'public';
} | {
    kind: 'node-ssh';
} | {
    kind: 'vault-token';
    secret: string;
    username?: string;
}
/** One-claim credential delivered only inside the hybrid-sealed node response. */
 | {
    kind: 'ephemeral-token';
    token: string;
    expiresAtTs: number;
    username?: string;
};
export interface DeploymentOptions {
    /** Queue key. The same deployment target is serial; different targets may run in parallel. */
    key: string;
    repository: string;
    branch: string;
    /**
     * Release-generation-one source copied by the attended operator. It is a
     * local Git bundle, never a network credential or a persistent CI source.
     */
    bootstrapBundle?: {
        path: string;
        manifest: BootstrapBundleManifest;
    };
    profile: string;
    root: string;
    publicApiUrl?: string;
    sourceAuth?: GitSourceAuth;
    gitCredentialPath?: string;
    /** Fixed typed SSH adapter installed beside fz-agent; Git invokes it directly. */
    gitSshPath?: string;
    knownHostsPath?: string;
    /** Server-owned, operator-pinned host keys for a dynamically assigned source. */
    knownHostsContent?: string;
    /** Test/embedding seam. Production uses the operating system resolver. */
    resolveGitHost?: GitHostResolver;
    cache?: Pick<SecretCache, 'get'>;
    /** Non-secret values explicitly passed to every project phase. */
    environment?: Record<string, string>;
    attestation?: AttestationSource;
    width?: number;
    /** Project commands run through a credential-free Unix identity in production. */
    projectExec?: (input: CommandInput) => Promise<CommandResult>;
    /** Test/embedding seam; provisioned hosts use the fixed deployment group. */
    releaseGroup?: string;
    /** Root-owned fixed strategy helper; repository data contains coordinates only. */
    ensureSoftware?: (requirements: readonly SoftwareRequirement[]) => Promise<unknown>;
    /** Root-owned bounded native/systemd/Nginx blue-green activation. */
    activateNative?: (request: NativeApplicationActivationRequest) => Promise<ServiceActivationState>;
    /** Root-owned fixed Docker builder; the project runner never receives the daemon socket. */
    buildContainer?: (request: ContainerBuildRequest) => Promise<ContainerBuildResult>;
    /** Root-owned bounded container/Nginx blue-green activation. */
    activateContainer?: (request: ContainerActivateRequest) => Promise<ServiceActivationState>;
    /** Root-owned Tunnel/WARP convergence using connector-scoped capabilities only. */
    applyConnectivity?: (request: DeploymentConnectivityRequest) => Promise<DeploymentConnectivityEvidence>;
    /** Root-owned, loopback-only standalone database activation for exclusive computes. */
    activateDatabase?: (request: StandaloneDatabaseActivationRequest) => Promise<StandaloneDatabaseActivationEvidence>;
    /** Agent-owned directory; definitions cannot choose or overwrite this path. */
    capacityEvidenceDirectory?: string;
    /** Test/embedding seam. Production runs the bounded loopback GET calibrator. */
    calibrateCapacity?: (options: CapacityCalibrationOptions) => Promise<CapacityCalibration>;
    exec?: (input: CommandInput) => Promise<CommandResult>;
    now?: () => number;
    readPlan?: (path: string) => unknown;
}
export declare class DeploymentError extends Error {
    readonly code: 'BAD_REVISION' | 'SOURCE_FAILED' | 'PIPELINE_FAILED' | 'SECRET_MISSING';
    readonly execution?: DeploymentExecution | undefined;
    constructor(code: 'BAD_REVISION' | 'SOURCE_FAILED' | 'PIPELINE_FAILED' | 'SECRET_MISSING', message: string, execution?: DeploymentExecution | undefined);
}
/**
 * One source and one pipeline owner.
 *
 * A request may choose an exact commit and carry the control plane's
 * deterministic release-executor decision. It cannot choose a repository, branch, working directory or
 * command: those are sealed into the agent unit and the checked-out definition.
 */
export declare function createDeploymentManager(options: DeploymentOptions): {
    latestRevision(): Promise<string>;
    deploy(request?: DeploymentRequest): QueueTask<DeploymentResult>;
    snapshot: () => {
        width: number;
        running: number;
        queued: number;
        keys: number;
        paused: boolean;
        intakePaused: boolean;
        pausedKeys: string[];
        stoppedKeys: string[];
        completed: number;
        failed: number;
    };
    pause: () => void;
    resume: () => void;
    pauseIntake: () => void;
    resumeIntake: () => void;
    whenIdle: () => Promise<void>;
    pauseKey: (key: string) => void;
    resumeKey: (key: string) => void;
    stopKey: (key: string) => number;
    startKey: (key: string) => boolean;
    cancel: (id: string) => boolean;
    stop(deadlineMs?: number): Promise<DrainReport>;
};
export type DeploymentManager = ReturnType<typeof createDeploymentManager>;