/**
 * Database providers — ArangoDB, with the same priority and health machinery
 * every other service gets.
 *
 * ## Why a database belongs in the registry at all
 *
 * Not for failover between databases — that is what a cluster is for, and
 * silently writing to a different database because the first was slow is data
 * loss with extra steps. It belongs here for two other reasons:
 *
 *   CREDENTIALS  the password lives in the same place as every other secret,
 *                so rotating it is a vault write rather than a redeploy
 *   HEALTH       three failed connections mark it degraded, and the same admin
 *                screen that shows email relays shows the database
 *
 * Coordinator routing below remains inside one authenticated cluster. It never
 * treats a different database or replica as an automatic write destination.
 */
/** Just enough of an ArangoDB client that this package imports nothing. */
export interface ArangoLike {
    query<T = unknown>(query: unknown, bindVars?: Record<string, unknown>, options?: {
        allowDirtyRead?: boolean;
    }): Promise<{
        all(): Promise<T[]>;
    }>;
    version?(): Promise<{
        version: string;
    }>;
    close?(): void | Promise<void>;
}
export interface ArangoConnectOptions {
    /** One coordinator from the verified list; the adapter owns selection. */
    url: string;
    database: string;
    username: string;
    password: string;
    loadBalancingStrategy: 'NONE';
    /** Always zero: only this adapter may decide whether replay is safe. */
    maxRetries: number;
}
export interface ArangoConfig {
    /** Backwards-compatible single-coordinator coordinate. */
    url?: string;
    /** Explicit authenticated private coordinators. Bounded to prevent config abuse. */
    urls?: readonly string[];
    /** Optional subset of `urls` preferred only by explicitly safe reads. */
    readPreferredUrls?: readonly string[];
    /** Whether a preferred read may fall back to the balanced writable pool. */
    readPreferredFallback?: 'balanced' | 'error';
    /**
     * Dynamic membership is accepted only as a signed/attested envelope verified
     * by the host. A Worker/KV node list by itself is discovery data, not routing
     * authority.
     */
    membership?: ArangoMembershipSnapshot;
    verifyMembership?: ArangoMembershipVerifier;
    /** Required with dynamic membership, preventing a valid list crossing clusters. */
    clusterId?: string;
    database: string;
    username: string;
    /** Built by the host, because a connection pool must outlive one call. */
    connect?: (options: ArangoConnectOptions) => ArangoLike;
    /** Maximum coordinator attempts for an explicitly safe request. */
    maxCoordinatorAttempts?: number;
    /** Local transport-failure quarantine. Primarily injectable for tests. */
    unhealthyForMs?: number;
    now?: () => number;
}
export interface Query {
    query: unknown;
    bindVars?: Record<string, unknown>;
    /**
     * No retry is the secure default. `read` and `idempotent` are explicit
     * caller assertions; this adapter never guesses AQL semantics from text.
     */
    retrySafety?: 'read' | 'idempotent' | 'never';
    /** Routing hint valid only with `retrySafety: read`; it never changes write routing. */
    readPreference?: 'balanced' | 'prefer-designated';
    /** Required when `retrySafety` is `idempotent`; retained for audit correlation. */
    idempotencyKey?: string;
}
export interface ArangoCoordinatorMember {
    url: string;
    /** Clients address Coordinators; Community 3.11.14 has no read-only joiner role. */
    role: 'coordinator';
    /** Actual `/_admin/server/mode` state for this Coordinator. */
    serverMode: 'default';
    capabilities: {
        /** Always false for the exact Community 3.11.14 contract. */
        dirtyFollowerReads: false;
    };
    status: 'healthy' | 'degraded' | 'unhealthy';
    /** Signed operator preference for safe reads; this is not an ArangoDB role. */
    readPreferred?: boolean;
    /** Milliseconds since epoch, covered by the membership signature/attestation. */
    observedAt: number;
    /** Enrolled hybrid identity. The node key is its Ed25519 public half. */
    nodeKey: string;
    publicKeys: {
        ed25519: string;
        mlDsa: string;
    };
}
export interface ArangoMembershipSnapshot {
    authority: 'forgezero-platform-signed' | 'node-attested';
    edition: 'community';
    version: '3.11.14';
    clusterId: string;
    revision: string;
    issuedAt: number;
    expiresAt: number;
    coordinators: readonly ArangoCoordinatorMember[];
}
export type ArangoMembershipVerifier = (snapshot: ArangoMembershipSnapshot, signal?: AbortSignal) => Promise<boolean>;
export declare const MAX_ARANGO_COORDINATORS = 16;
export declare const ARANGO_COMMUNITY_VERSION: "3.11.14";
/** Protected API used to attest cluster-wide `default`/maintenance mode. */
export declare const ARANGO_SERVER_MODE_PATH: "/_admin/server/mode";
/**
 * Accept only an explicit, bounded set of private authenticated endpoints.
 * Service discovery may propose a new list, but it must pass this authority
 * boundary before a fresh pool is created; public Worker/KV state is never a
 * database routing authority.
 */
export declare function arangoCoordinatorUrls(config: Pick<ArangoConfig, 'url' | 'urls'>): readonly string[];
export declare const arangodb: import("./index").ProviderDefinition<Record<"query", import("./index").ProviderMethodSpec<Query, unknown[]>>>;
/** Drop memoised connections. Tests, and after a credential rotation. */
export declare function resetPools(): void;
export declare const databaseProviders: readonly [import("./index").ProviderDefinition<Record<"query", import("./index").ProviderMethodSpec<Query, unknown[]>>>];