import type { NodeKeyPair } from '@forgezero/runtime/identity';
import type { AgentOperationTelemetry } from './telemetry-runtime';
import { type GitHostResolver } from './git-egress';
import { type MetalBootstrapConfig } from './metal-bootstrap';
/**
 * A bundled Agent's import URL may resolve through `/usr/local/bin/fz-agent`,
 * while the immutable sibling artifacts live under the canonical install
 * directory. Prefer that reviewed coordinate and retain the module-relative
 * path only for source execution and tests.
 */
export declare function packagedAgentArtifactPath(name: 'fz.js' | 'fz-agent.js', exists?: (path: string) => boolean): string;
export interface RemoteSshBootstrapClaim {
    computeKey: string;
    computeReference: string;
    claimToken: string;
    claimExpiresAtTs: number;
    attempt: number;
    realm: string;
    projectKey: string;
    environmentKey: string;
    runnerSshPublicKey: string;
    target: {
        host: string;
        port: number;
        user: string;
        hostKeySha256: string;
        nodeHostname: string;
        operatingSystem: {
            id: 'ubuntu';
            version: '24.04' | '26.04';
            architecture: 'x64';
        };
        credential: {
            source: 'runner';
        } | {
            source: 'vault';
            kind: 'private-key';
            privateKey: string;
        } | {
            source: 'vault';
            kind: 'password';
            password: string;
        };
    };
    enrolmentToken: string;
}
export interface RemoteMetalAdmissionClaim {
    jobKey: string;
    claimToken: string;
    claimExpiresAtTs: number;
    attempt: number;
    tenantKey: string;
    projectKey: string;
    environmentKey: string;
    hostname: string;
    label: string;
    regionKey: string;
    runnerNodeKey: string;
    runnerSshPublicKey: string;
    challenge: string;
    target: RemoteSshBootstrapClaim['target'];
}
type MetalAdmissionProvisioning = Pick<MetalBootstrapConfig['profile'], 'volumeGroup' | 'bridge' | 'subnetPrefix' | 'addressStart' | 'addressEnd' | 'gateway' | 'nameservers' | 'cpuPools' | 'housekeepingCpus'>;
/**
 * Convert runner-observed Linux CPU topology into the fixed ForgeZero host
 * boundary. The browser never authors this capacity. One physical core and all
 * of its SMT siblings remain reserved for the host; every other complete core
 * becomes the initial allocatable pool.
 */
export declare function deriveMetalAdmissionProvisioning(lscpu: string): MetalAdmissionProvisioning;
export interface MetalAdmissionProof {
    jobKey: string;
    tenantKey: string;
    projectKey: string;
    hostname: string;
    runnerNodeKey: string;
    challenge: string;
    target: {
        host: string;
        port: number;
        user: string;
        hostKeySha256: string;
    };
    publicKeys: {
        ed25519: string;
        mlDsa: string;
    };
    preflight: {
        vcpu: number;
        memoryGib: number;
        diskGib: number;
        kvm: boolean;
        snpHost: boolean;
        helper: boolean;
    };
    envelope: {
        version: 1;
        suite: 'ed25519+ml-dsa-65';
        nodeKey: string;
        timestamp: number;
        nonce: string;
        edSignature: string;
        mlDsaSignature: string;
    };
}
export type MetalAdmissionStage = 'validating-target' | 'resolving-host' | 'verifying-host-key' | 'opening-ssh' | 'installing-managed-key' | 'checking-host-policy' | 'copying-agent' | 'installing-runtime' | 'bootstrapping-agent' | 'verifying-proof';
export interface BootstrapCommandResult {
    exitCode: number;
    output: string;
}
export type BootstrapCommand = (argv: readonly string[], options?: {
    stdin?: string;
    secret?: boolean;
    env?: Record<string, string>;
    timeoutMs?: number;
}) => Promise<BootstrapCommandResult>;
export interface SshBootstrapPullOptions {
    apiUrl: string;
    platformApiUrl: string;
    nodeKey: string;
    keys: NodeKeyPair;
    sshKeyPath: string;
    targetTelemetryEndpoint: string;
    fzCliPath?: string;
    fzAgentPath?: string;
    exec?: BootstrapCommand;
    fetch?: (input: URL, init: RequestInit) => Promise<Response>;
    intervalMs?: number;
    requestTimeoutMs?: number;
    now?: () => number;
    setTimer?: (callback: () => void, ms: number) => unknown;
    clearTimer?: (handle: unknown) => void;
    onEvent?: (event: string, detail?: unknown) => void;
    telemetry?: AgentOperationTelemetry;
    resolveHost?: GitHostResolver;
    canClaim?: () => boolean;
    onMetalAdmissionProgress?: (stage: MetalAdmissionStage, evidence?: {
        hostKeySha256?: string;
    }) => Promise<void>;
}
export type SshBootstrapResult = {
    status: 'idle';
} | {
    status: 'completed';
    computeKey: string;
    attempt: number;
} | {
    status: 'failed';
    computeKey: string;
    attempt: number;
    failureCode: string;
};
export declare class SshBootstrapError extends Error {
    readonly code: string;
    constructor(code: string, message?: string);
}
/** Execute one job without ever putting the enrolment token or SSH key in argv. */
export declare function executeSshBootstrap(claim: RemoteSshBootstrapClaim, options: Pick<SshBootstrapPullOptions, 'platformApiUrl' | 'sshKeyPath' | 'targetTelemetryEndpoint' | 'fzCliPath' | 'fzAgentPath' | 'exec' | 'resolveHost'>): Promise<void>;
export declare function pullSshBootstrapOnce(options: SshBootstrapPullOptions): Promise<SshBootstrapResult>;
export declare function startSshBootstrapPull(options: SshBootstrapPullOptions): {
    stop(): Promise<void>;
    pause(): Promise<void>;
    resume(): void;
    readonly active: boolean;
};
export type MetalAdmissionResult = {
    status: 'idle';
} | {
    status: 'completed';
    jobKey: string;
    attempt: number;
} | {
    status: 'failed';
    jobKey: string;
    attempt: number;
    failureCode: string;
};
/** Install the fixed metal Agent profile, then ask that host—not the runner—to sign its local preflight. */
export declare function executeMetalAdmission(claim: RemoteMetalAdmissionClaim, options: Pick<SshBootstrapPullOptions, 'platformApiUrl' | 'sshKeyPath' | 'targetTelemetryEndpoint' | 'fzCliPath' | 'fzAgentPath' | 'exec' | 'resolveHost' | 'onMetalAdmissionProgress'>): Promise<MetalAdmissionProof>;
export declare function pullMetalAdmissionOnce(options: SshBootstrapPullOptions): Promise<MetalAdmissionResult>;
export declare function startMetalAdmissionPull(options: SshBootstrapPullOptions): {
    stop(): Promise<void>;
    pause(): Promise<void>;
    resume(): void;
    readonly active: boolean;
};
export {};