export type CatalogStatus = 'testing' | 'active' | 'retired';
export type DeploymentChannel = 'development' | 'production';
export type SoftwareId = 'bun' | 'docker' | 'containerd' | 'kata-containers' | 'nginx' | 'arangodb' | 'cloudflared' | 'cloudflare-warp' | 'ufw' | 'openssh-client' | 'git';
/** Repository input is a catalogue coordinate, never a root command. */
export interface SoftwareRequirement {
    id: SoftwareId;
    version: string;
}
export interface SoftwareCatalogEntry extends SoftwareRequirement {
    billingClass: 'free-managed' | 'paid-managed';
    status: CatalogStatus;
    os: 'ubuntu';
    osVersion: '24.04' | '26.04';
    architecture: 'x64';
    /** What promotes this coordinate beyond an unreviewed candidate. */
    evidence: 'reviewed-strategy-and-tests';
}
/** Browser-safe evidence for one distinct managed software coordinate. */
export type ManagedSoftwareEvidence = Pick<SoftwareCatalogEntry, 'id' | 'version' | 'billingClass'>;
export interface OsCatalogEntry {
    id: 'ubuntu';
    version: '24.04' | '26.04';
    architecture: 'x64';
    status: CatalogStatus;
    imageKey: 'ubuntu-noble-20260705' | 'ubuntu-resolute-20260731';
    imageLabel: 'Ubuntu 24.04 LTS Noble' | 'Ubuntu 26.04 LTS Resolute';
    imageVersion: '2026-07-05' | '2026-07-31';
    imageUrl: string;
    imageSha256: string;
    confidentialModes: readonly [] | readonly ['sev-snp'];
}
export interface SoftwareObservation {
    os: {
        id: string;
        versionId: string;
    };
    architecture: string;
}
export interface SoftwareCommandResult {
    exitCode: number;
    output: string;
}
export type SoftwareOperation = {
    kind: 'check';
    software: SoftwareId;
    version: string;
} | {
    kind: 'install';
    software: SoftwareId;
    version: string;
};
export type SoftwareExec = (operation: SoftwareOperation) => Promise<SoftwareCommandResult>;
export declare const PINNED_BUN_VERSION = "1.3.14";
export declare const BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
export declare const NERDCTL_VERSION = "2.3.5";
export declare const BUILDKIT_VERSION = "0.32.2";
export declare const KATA_CONTAINERS_VERSION = "4.0.0";
/** Public, command-free catalog. Root strategies remain private below. */
export declare const OS_CATALOG: readonly OsCatalogEntry[];
export declare const SOFTWARE_CATALOG: readonly SoftwareCatalogEntry[];
export declare const softwareBillingClass: (requirement: SoftwareRequirement) => SoftwareCatalogEntry["billingClass"];
/** Canonical inventory reported after a successful deployment. */
export declare const managedSoftwareEvidence: (requirements: readonly SoftwareRequirement[]) => ManagedSoftwareEvidence[];
/** Counts distinct paid software instances managed on one compute. */
export declare const countPaidManagedSoftware: (requirements: readonly SoftwareRequirement[]) => number;
export declare const softwareSpawnFailure: (cause: unknown, argv: readonly string[]) => SoftwareCommandResult | undefined;
export declare const runSoftwareCommand: (argv: readonly string[], env?: Record<string, string>) => Promise<SoftwareCommandResult>;
export declare const softwareDownloadCommand: (url: string, destination: string, maximumBytes: number) => readonly string[];
/** Closed, fixed-argv privileged strategy executor. No repository value becomes a command. */
export declare function executeSoftwareOperation(operation: SoftwareOperation): Promise<SoftwareCommandResult>;
export declare function observeSoftwareHost(osRelease?: string, architecture?: NodeJS.Architecture): SoftwareObservation;
export declare function validateSoftwareRequirements(value: unknown, _options?: {
    channel?: DeploymentChannel;
}): SoftwareRequirement[];
export declare function ensureSoftwareRequirements(requirementsInput: unknown, options: {
    observation?: SoftwareObservation;
    exec: SoftwareExec;
}): Promise<Array<{
    id: string;
    version: string;
    changed: boolean;
}>>;