import { type MetalCommandResult, type MetalProvisionProfile } from './metal-provision';
declare const PROFILE_PATH = "/etc/forgezero/metal.json";
export declare const METAL_BOOTSTRAP_STATE_PATH = "/etc/forgezero/metal.initialized.json";
export interface MetalBootstrapConfig {
    kind: 'metal';
    metalHostname: string;
    profile: MetalProvisionProfile;
    hostTelemetryEndpoint: 'http://127.0.0.1:4318';
    hostTelemetryUnit: string;
    /** Optional operator-supplied entropy. Consumed after PID 1 seals it. */
    agentSeedFile?: string;
}
export interface MetalBootstrapPlan {
    kind: 'metal';
    metalHostname: string;
    profilePath: typeof PROFILE_PATH;
    units: readonly string[];
    steps: readonly string[];
    requiresRoot: true;
    consumes: readonly string[];
}
export interface MetalBootstrapStatus {
    initialized: boolean;
    profileValid: boolean;
    profileMode: number | null;
    imageVerified: boolean;
    units: Record<string, 'active' | 'inactive' | 'missing'>;
    helperSocketReady: boolean;
    updateSocketReady: boolean;
    metalHostname?: string;
    installedAgentVersion?: string;
    problems: string[];
}
export interface MetalBootstrapResult extends MetalBootstrapStatus {
    publicIdentity: string;
}
export type MetalBootstrapExec = (argv: readonly string[], stdin?: string) => Promise<MetalCommandResult>;
export interface MetalBootstrapApplyOptions {
    agentSourcePath: string;
    repair?: boolean;
    exec?: MetalBootstrapExec;
    getuid?: () => number;
}
export declare class MetalBootstrapError extends Error {
}
export interface MetalPublicIdentity {
    nodeKey: string;
    publicKeys: {
        ed25519: string;
        mlDsa: string;
    };
}
export declare function parseMetalPublicIdentity(value: string): MetalPublicIdentity;
export declare function normalizeMetalPublicIdentity(value: string): string;
export interface MetalBootstrapValidationOptions {
    /**
     * Read identity/topology from a config that was already applied by an older
     * Agent release. New installs and repairs must never set this flag.
     */
    allowHistoricalRelease?: boolean;
}
export declare function validateMetalBootstrapConfig(config: MetalBootstrapConfig, options?: MetalBootstrapValidationOptions): MetalBootstrapConfig;
/** Reject symlinks and group/world access before parsing coordinates or entropy. */
export declare function validateOwnerOnlyPath(path: string, requireRootOwner: boolean): void;
export declare function readMetalBootstrapConfig(path: string, options?: MetalBootstrapValidationOptions): MetalBootstrapConfig;
export declare function planMetalBootstrap(config: MetalBootstrapConfig): MetalBootstrapPlan;
export declare function renderMetalUnits(config: MetalBootstrapConfig): Record<string, string>;
export declare function applyMetalBootstrap(config: MetalBootstrapConfig, options: MetalBootstrapApplyOptions): Promise<MetalBootstrapResult>;
export declare function metalBootstrapStatus(exec?: MetalBootstrapExec): Promise<MetalBootstrapStatus>;
export {};