import type { ValidationReport } from "./doctor.js";
import { validateMonoAgentFolder } from "./doctor.js";
import type { SecretPersistenceOutcome } from "./init.js";
import type { WizardPlan } from "./wizard/answers.js";
export type CliEnvironment = Readonly<Record<string, string | undefined>>;
export interface CliDotenvSnapshot {
    readonly env: Readonly<Record<string, string>>;
    /** Opaque content + mode fingerprint; never contains a plaintext dotenv value. */
    readonly fingerprint: string;
}
export interface CliConfigSnapshot {
    /** Exact UTF-8 bytes read from the regular config file. Config never contains persisted secrets. */
    readonly contents: string;
    readonly digest: string;
    /** Content plus file identity/mode fingerprint used to detect edits and replacement. */
    readonly fingerprint: string;
}
/**
 * Run one guided-init operation with exactly the durable worker environment.
 *
 * Provider SDKs and CLI bridges still consult `process.env` internally, so an
 * `env` argument used only for config loading is not enough. Guided init is a
 * single-purpose CLI path; serialize these temporary global swaps, hold the
 * selected environment for the whole async operation, and restore the complete
 * caller snapshot on every exit path.
 */
export declare function withExactProcessEnvironment<T>(env: CliEnvironment, task: () => Promise<T>): Promise<T>;
/** Whether guided setup consumed any durable dotenv value that should be owner-only and untracked. */
export declare function hasSensitivePersistedEnvironmentValue(env: CliEnvironment): boolean;
/** Read and fingerprint dotenv without changing process.env. A missing file is empty. */
export declare function readCliDotenvSnapshot(path: string): Promise<CliDotenvSnapshot>;
/** Read a dotenv file without changing process.env. A missing file is empty. */
export declare function readCliDotenvFile(path: string): Promise<Record<string, string>>;
/** Read one exact config snapshot without following the final path component. */
export declare function readCliConfigSnapshot(path: string): Promise<CliConfigSnapshot>;
/**
 * Build the durable environment proven by guided init and later used by its
 * immediate start. Shell-only provider credentials and MONO_AGENT_* overrides
 * are intentionally absent; only worker-operational host values survive.
 * Operational values win over dotenv exactly as `process.loadEnvFile` and the
 * launchd plist do, while entered secrets and resolved Pi auth remain explicit.
 */
export declare function effectiveFirstRunEnvironment(options: {
    readonly shellEnv: CliEnvironment;
    readonly dotenvEnv: CliEnvironment;
    readonly enteredSecrets?: CliEnvironment;
    readonly resolvedPiAuthPath?: string;
}): Record<string, string | undefined>;
/**
 * Persisted mono-agent config overrides that could make the generated JSON say
 * something different from the runtime. Secret values and the selected Pi
 * credential-store path are data inputs, not config substitutions, so remain
 * allowed. Returned names are sorted for deterministic operator output.
 */
export declare function unexpectedPersistedMonoAgentOverrides(plan: WizardPlan, dotenvEnv: CliEnvironment): readonly string[];
/** Selected secret names whose shell and persisted values would diverge. */
export declare function selectedSecretEnvironmentConflicts(plan: WizardPlan, shellEnv: CliEnvironment, dotenvEnv: CliEnvironment, enteredSecrets?: CliEnvironment): readonly string[];
/** All selected secret values used by the live probe, including persisted ones. */
export declare function selectedSecretValues(plan: WizardPlan, env: CliEnvironment): Readonly<Record<string, string>>;
/**
 * Resolve the one Pi credential store used by discovery, setup, validation and
 * runtime. Inputs are already ordered by their documented precedence.
 */
export declare function resolveEffectivePiAuthPath(options: {
    readonly cwd: string;
    readonly explicitPath?: string;
    readonly envPath?: string;
    readonly configPath?: string;
}): string;
/** Whether an exported shell override would select a different background store. */
export declare function piAuthPathBackgroundConflict(options: {
    readonly cwd: string;
    readonly shellPath?: string | undefined;
    readonly dotenvPath?: string | undefined;
    readonly configPath?: string | undefined;
}): boolean;
export interface FirstRunReadinessGate {
    readonly ready: boolean;
    readonly reasons: readonly string[];
}
/**
 * Gate the generated capability configuration before any paid or slow model
 * checks. A waiting credential section is deliberately deferred to the exact
 * live route proof; every other selected expectation must already be ready.
 */
export declare function evaluateFirstRunConfigurationReadiness(options: {
    readonly plan: WizardPlan;
    readonly report: ValidationReport;
    readonly secretPersistence: SecretPersistenceOutcome;
}): FirstRunReadinessGate;
/** A first-run claim also requires exact live route proofs beyond generic operational readiness. */
export declare function evaluateFirstRunReadiness(options: {
    readonly plan: WizardPlan;
    readonly report: ValidationReport;
    readonly secretPersistence: SecretPersistenceOutcome;
    /** Exact persistent runtime routes proven by successful live no-tool turns. */
    readonly verifiedCredentialModelRefs?: readonly string[];
}): FirstRunReadinessGate;
export interface ValidateWizardPlanInStagingOptions {
    readonly plan: WizardPlan;
    /** Folder whose existing relative context roots the generated plan references. */
    readonly sourceCwd?: string;
    readonly env: Record<string, string | undefined>;
    readonly verifiedCredentialModelRefs: readonly string[];
    /** Cooperative cancellation checked between every staging phase and before returning validation. */
    readonly abortSignal?: AbortSignal;
    readonly validate?: typeof validateMonoAgentFolder;
}
/** Validate the full plan in a disposable folder before touching the target. */
export declare function validateWizardPlanInStaging(options: ValidateWizardPlanInStagingOptions): Promise<ValidationReport>;
//# sourceMappingURL=first-run-readiness.d.ts.map