import { type ApplyClient, type RemoteConnectorDefinition } from "./client.js";
import { type DesiredState, type DesiredAutomation } from "./desired-state.js";
import { type DiffPlan, type RemoteSnapshot } from "./diff.js";
interface ApplyOptions {
    cwd?: string;
    dryRun?: boolean;
    yes?: boolean;
    only?: "agents" | "memory";
    org?: string;
    url?: string;
    /** Bypass the project-link guard. */
    force?: boolean;
    /**
     * Clear the promotions pause a `lobu rollback` set and proceed. Without it,
     * apply refuses while the org is paused — CI must never silently re-promote
     * over a deliberate rollback.
     */
    resume?: boolean;
    /** CLI version stamped into the deployment summary. */
    cliVersion?: string;
    /** Test seam — inject a stubbed fetch. */
    fetchImpl?: typeof fetch;
}
export interface PendingAuthEntry {
    slug: string;
    kind: string;
    connectUrl?: string;
}
/** Resolve declarative connection slugs to the integer API contract. */
export declare function resolveAutomationConnectionRefs(automations: DesiredAutomation[], connectionIdBySlug: ReadonlyMap<string, number>, requireResolved: boolean): void;
/**
 * Read a response body as a stream, counting *bytes* and aborting as soon as
 * the running total exceeds `maxBytes` — before buffering the rest. Decodes to
 * UTF-8 text only after the (bounded) body is in hand. Exported for testing.
 */
export declare function readBoundedBody(res: Response, maxBytes: number, onOverflow: () => never): Promise<string>;
export declare function fetchRemoteSnapshot(client: ApplyClient, state: DesiredState, only?: "agents" | "memory", prune?: boolean, orgId?: string): Promise<RemoteSnapshot>;
/**
 * Validate connection / auth-profile config against the connector definitions
 * the server knows about. When `skipSchemaForConnectorKeys` is given, those
 * connector keys (the locally-declared `*.connector.ts` / `type: connector`
 * ones) get only the structural checks here — full JSON-schema validation runs
 * later, after install + catalog refetch, against the *fresh* schemas. This
 * avoids rejecting a connection's config against a stale installed schema when
 * the same apply updates that connector.
 */
interface ValidateConnectorStateOptions {
    /**
     * Connector keys whose JSON-schema validation should be skipped in this pass
     * (the locally-declared ones in the *pre*-install pass — they're schema-
     * validated post-install against the fresh catalog).
     */
    skipSchemaForConnectorKeys?: ReadonlySet<string>;
    /**
     * When true (the *post*-install pass), every connector key referenced by a
     * desired auth profile or connection must be present in the catalog with
     * `installed === true` — otherwise a hard `ValidationError` before any
     * `executePlan` mutation. Catches a typo'd `connector:` ref, or a local
     * `*.connector.ts` whose compiled `definition.key` differs from what the
     * manifest assumed (so it never got installed under the expected key).
     */
    requireInstalled?: boolean;
}
export declare function validateConnectorState(state: DesiredState, connectorDefinitions: RemoteConnectorDefinition[], opts?: ValidateConnectorStateOptions): string[];
export declare function locallyDeclaredConnectorKeys(state: DesiredState): Set<string>;
/**
 * Active-version pins for every config-relevant connector key, read from a
 * catalog snapshot. Used when the apply didn't (re)install connectors (all-noop
 * plans) and as the fallback layer under a partial failure's install results.
 */
export declare function connectorVersionPins(state: DesiredState, catalog: RemoteConnectorDefinition[]): Record<string, string>;
interface ApplyContext {
    client: ApplyClient;
    state: DesiredState;
    plan: DiffPlan;
    remote: RemoteSnapshot;
}
/**
 * Push provider API keys into the org's `inference_providers` store — the
 * single org-key store the worker credential resolution reads (post
 * resolver-cutover; the legacy `/agents/<id>/providers/<id>/api-key` route is
 * gone). A key declared per agent in config is an ORG-scoped secret, so keys
 * are deduped by provider — last declaration wins, matching the previous
 * PUT-overwrite semantics — and pushed once each: rotate when the org
 * provider row exists, create the row otherwise (slug doubles as kind;
 * per-agent provider ids are catalog kinds). Idempotent either way. Walks all
 * desired agents (not just those with a settings diff) — the secret value
 * isn't part of the settings JSON, so a key can need pushing even when every
 * resource is noop (e.g. a key-only `.env` change/rotation).
 */
export declare function pushProviderApiKeys(client: ApplyClient, agents: DesiredState["agents"]): Promise<void>;
export declare function executePlan(ctx: ApplyContext, pendingAuth: PendingAuthEntry[]): Promise<{
    connectorVersions: Record<string, string>;
}>;
export declare function applyCommand(opts?: ApplyOptions): Promise<void>;
export {};
//# sourceMappingURL=apply-cmd.d.ts.map