#!/usr/bin/env bun
import { Command } from "commander";
import type { PoolQueryClient, TypedQueryClient } from "../generated/storage-kit/query.js";
import { PostgresStorage } from "../lib/storage/postgres.js";
type ServiceDatabaseRole = "open_loops_runtime" | "open_loops_authenticator";
export type ServeReadinessFailureCode = "storage_unreachable" | "migration_checksum_mismatch";
export declare function classifyMigrationReadinessError(error: unknown): ServeReadinessFailureCode;
export declare function isSafeServiceConnection(client: TypedQueryClient, expectedRole: ServiceDatabaseRole): Promise<boolean>;
export declare function isTenantRlsInvariantSafe(client: TypedQueryClient): Promise<boolean>;
export declare function assertTenantEnforcementBootstrap(client: PoolQueryClient): Promise<void>;
export declare function assertTenantEnforcementBootstrapIfPending(client: PoolQueryClient, schema: PostgresStorage): Promise<void>;
declare const program: Command;
export interface ProvisionRunnerKeyCliOptions {
    runnerId?: string;
    tenantId?: string;
    roles?: string;
    scope?: string;
    ttlSeconds?: number;
    tokenOut?: string;
    printToken?: boolean;
}
export declare function splitCsv(value: string | undefined): string[];
/** Write the token to a file at mode 600 (fchmod after open, so umask cannot widen it). */
export declare function writeTokenFile(path: string, token: string): void;
export declare function runProvisionRunnerKeyCommand(opts: ProvisionRunnerKeyCliOptions, env?: Record<string, string | undefined>): Promise<{
    runnerId: string;
    kid: string;
    expiresAt: string | null;
    provisioned: boolean;
}>;
/**
 * Command body with an injectable client — the seam the CLI tests use. All
 * validation and delivery behavior lives here so the unit tests exercise the
 * exact stdout/file/print-token contract without a database.
 */
export declare function runProvisionRunnerKeyWithClient(opts: ProvisionRunnerKeyCliOptions, env: Record<string, string | undefined>, client: PoolQueryClient): Promise<{
    runnerId: string;
    kid: string;
    expiresAt: string | null;
    provisioned: boolean;
}>;
export declare function logServeCommandFailure(error: unknown): void;
export declare function classifyTenantEnforcementGate(error: unknown): {
    gate: string;
    action: string;
} | undefined;
export { program };