import * as z from "zod/v4-mini";
/**
 * CPU architecture the image was built for. Validated against the provider at preflight.
 */
export declare enum DefinitionProviderArch {
    X8664 = "x86_64",
    Arm64 = "arm64"
}
/**
 * Requested resources. A provider that does not expose a given dial REJECTS a definition that sets it, at preflight — never a silent downgrade.
 */
export type DefinitionProviderResources = {
    /**
     * Requested vCPU count
     */
    vcpu?: number | undefined;
    /**
     * Requested memory in MB
     */
    memoryMb?: number | undefined;
    /**
     * Requested disk in MB
     */
    diskMb?: number | undefined;
    /**
     * Whether a GPU is required
     */
    gpu?: boolean | undefined;
};
/**
 * Outbound policy. Defaults to deny — opening egress is explicit.
 */
export declare enum DefinitionProviderEgress {
    Deny = "deny",
    Allowlist = "allowlist",
    Allow = "allow"
}
/**
 * What this rule constrains
 */
export declare enum DefinitionProviderKind {
    Port = "port",
    Cidr = "cidr",
    Domain = "domain"
}
/**
 * A single outbound-access allowance
 */
export type DefinitionProviderAllow = {
    /**
     * What this rule constrains
     */
    kind?: DefinitionProviderKind | undefined;
    /**
     * Port, CIDR block, or domain
     */
    value: string;
};
/**
 * Network policy for the sandbox
 */
export type DefinitionProviderNetwork = {
    /**
     * Outbound policy. Defaults to deny — opening egress is explicit.
     */
    egress?: DefinitionProviderEgress | undefined;
    /**
     * Allowances, when egress is "allowlist". Requires provider egressControl support.
     */
    allow?: Array<DefinitionProviderAllow> | undefined;
};
/**
 * Whether the working directory is archived at every consistency point. `auto` (default) archives it whenever an object store exists; `never` records the leg as disabled in the checkpoint manifest, so a restore reports it as disabled rather than as an archive that failed to travel.
 */
export declare enum DefinitionProviderWorkspace {
    Auto = "auto",
    Never = "never"
}
/**
 * Which legs continuous capture carries for sessions on this definition.
 */
export type DefinitionProviderCapture = {
    /**
     * Whether the working directory is archived at every consistency point. `auto` (default) archives it whenever an object store exists; `never` records the leg as disabled in the checkpoint manifest, so a restore reports it as disabled rather than as an archive that failed to travel.
     */
    workspace?: DefinitionProviderWorkspace | undefined;
    /**
     * Whether `$HOME/.mutagent` (memory, plans, extension state; never the session transcript) is archived. Defaults to true.
     */
    home?: boolean | undefined;
};
/**
 * Sandbox configuration. Separate artifact from the image content (R-C20).
 */
export type Definition = {
    /**
     * Human-readable definition name
     */
    name: string;
    /**
     * Image reference (repository:tag or @digest). The image content is a separate artifact.
     */
    image: string;
    /**
     * CPU architecture the image was built for. Validated against the provider at preflight.
     */
    arch?: DefinitionProviderArch | undefined;
    /**
     * Requested resources. A provider that does not expose a given dial REJECTS a definition that sets it, at preflight — never a silent downgrade.
     */
    resources?: DefinitionProviderResources | undefined;
    /**
     * Network policy for the sandbox
     */
    network?: DefinitionProviderNetwork | undefined;
    /**
     * Name of the Environment (secrets + variables) to load at spawn. Distinct from `provider`.
     */
    environment?: string | undefined;
    /**
     * Provider registry key. When omitted the backend default applies.
     */
    provider?: string | undefined;
    /**
     * Requested max lifetime. Rejected at preflight if it exceeds the provider ceiling.
     */
    timeoutMs?: number | undefined;
    /**
     * Working directory inside the sandbox
     */
    workdir?: string | undefined;
    /**
     * Non-secret environment variables. Secret material must come from an Environment.
     */
    vars?: {
        [k: string]: string;
    } | undefined;
    /**
     * Which legs continuous capture carries for sessions on this definition.
     */
    capture?: DefinitionProviderCapture | undefined;
};
export type DefinitionProvider = {
    /**
     * Sandbox configuration. Separate artifact from the image content (R-C20).
     */
    definition: Definition;
    provider?: string | undefined;
};
/** @internal */
export declare const DefinitionProviderArch$outboundSchema: z.ZodMiniEnum<typeof DefinitionProviderArch>;
/** @internal */
export type DefinitionProviderResources$Outbound = {
    vcpu?: number | undefined;
    memoryMb?: number | undefined;
    diskMb?: number | undefined;
    gpu?: boolean | undefined;
};
/** @internal */
export declare const DefinitionProviderResources$outboundSchema: z.ZodMiniType<DefinitionProviderResources$Outbound, DefinitionProviderResources>;
export declare function definitionProviderResourcesToJSON(definitionProviderResources: DefinitionProviderResources): string;
/** @internal */
export declare const DefinitionProviderEgress$outboundSchema: z.ZodMiniEnum<typeof DefinitionProviderEgress>;
/** @internal */
export declare const DefinitionProviderKind$outboundSchema: z.ZodMiniEnum<typeof DefinitionProviderKind>;
/** @internal */
export type DefinitionProviderAllow$Outbound = {
    kind: string;
    value: string;
};
/** @internal */
export declare const DefinitionProviderAllow$outboundSchema: z.ZodMiniType<DefinitionProviderAllow$Outbound, DefinitionProviderAllow>;
export declare function definitionProviderAllowToJSON(definitionProviderAllow: DefinitionProviderAllow): string;
/** @internal */
export type DefinitionProviderNetwork$Outbound = {
    egress: string;
    allow?: Array<DefinitionProviderAllow$Outbound> | undefined;
};
/** @internal */
export declare const DefinitionProviderNetwork$outboundSchema: z.ZodMiniType<DefinitionProviderNetwork$Outbound, DefinitionProviderNetwork>;
export declare function definitionProviderNetworkToJSON(definitionProviderNetwork: DefinitionProviderNetwork): string;
/** @internal */
export declare const DefinitionProviderWorkspace$outboundSchema: z.ZodMiniEnum<typeof DefinitionProviderWorkspace>;
/** @internal */
export type DefinitionProviderCapture$Outbound = {
    workspace: string;
    home?: boolean | undefined;
};
/** @internal */
export declare const DefinitionProviderCapture$outboundSchema: z.ZodMiniType<DefinitionProviderCapture$Outbound, DefinitionProviderCapture>;
export declare function definitionProviderCaptureToJSON(definitionProviderCapture: DefinitionProviderCapture): string;
/** @internal */
export type Definition$Outbound = {
    name: string;
    image: string;
    arch: string;
    resources?: DefinitionProviderResources$Outbound | undefined;
    network?: DefinitionProviderNetwork$Outbound | undefined;
    environment?: string | undefined;
    provider?: string | undefined;
    timeoutMs?: number | undefined;
    workdir?: string | undefined;
    vars?: {
        [k: string]: string;
    } | undefined;
    capture?: DefinitionProviderCapture$Outbound | undefined;
};
/** @internal */
export declare const Definition$outboundSchema: z.ZodMiniType<Definition$Outbound, Definition>;
export declare function definitionToJSON(definition: Definition): string;
/** @internal */
export type DefinitionProvider$Outbound = {
    definition: Definition$Outbound;
    provider?: string | undefined;
};
/** @internal */
export declare const DefinitionProvider$outboundSchema: z.ZodMiniType<DefinitionProvider$Outbound, DefinitionProvider>;
export declare function definitionProviderToJSON(definitionProvider: DefinitionProvider): string;
//# sourceMappingURL=definition-provider.d.ts.map