import type { ResolvedWatchdog } from './config.js';
import type { WatchdogReport } from './report.js';
import { type IdentityProvisioner } from '../creation.js';
import { type FleetConfig } from '../config.js';
/** A minimal handle over the launched child: kill it, or await its natural exit. */
export interface WatchdogChildHandle {
    kill(): void;
    exited: Promise<void>;
}
export interface WatchdogRunDeps {
    binPath: string;
    log(line: string): void;
    now?(): Date;
    sleep?(ms: number): Promise<void>;
    identityProvisioner?: IdentityProvisioner;
    /**
     * Injectable child launcher for tests. Default: spawn
     * `node <binPath> _run-watchdog <roleName>` detached:false, stdio to
     * `<runDir>/run.log`. Returns kill() and an exited promise.
     */
    launchChild?(binPath: string, roleName: string, runDir: string): WatchdogChildHandle;
    /** Pre-loaded config (defaults inheritance). Falls back to `loadConfig()`. */
    cfg?: FleetConfig;
    /** Live temporary-role discovery override for focused tests. */
    discoverLiveTemporaryRoles?(): Promise<string[]>;
}
export interface WatchdogRunOutcome {
    report: WatchdogReport;
    storedPath: string;
}
/**
 * Run one watchdog agent end-to-end in a clean-context temp state dir: provision
 * identity, materialize the run's contract (briefing/manifest/role snapshot),
 * launch the child, enforce a deadline against report.json as the completion
 * sentinel, harvest whatever it wrote (or a synthetic error report if it
 * didn't), store the result, and always clean up the temp dir.
 *
 * The scheduler's run-lock guarantees only one run per watchdog at a time;
 * this function itself takes no lock.
 */
export declare function executeWatchdogRun(wd: ResolvedWatchdog, deps: WatchdogRunDeps): Promise<WatchdogRunOutcome>;
/**
 * Deliver one scheduler-level alert (e.g. held-down) by launching a minimal one-shot temp agent
 * under the watchdog's own identity whose entire mission is: bind identity, send `text` to
 * `wd.coordinator`, write `sent.json`, exit. The fleet process itself cannot send ours messages
 * (owner-approved deviation 4), so this is how a scheduler tick that can't reach an operator any
 * other way still gets a message out.
 *
 * Reuses the ordinary run machinery (temp-dir prep, ensureIdentity, ResolvedRole shape, child
 * launch, kill mechanics) but stores no report, touches no ledger findings, and writes no
 * watch.json manifest — `sent.json` is this run's only completion sentinel. A fixed 2-minute
 * deadline applies regardless of `wd.timeoutMs`.
 *
 * Unlike executeWatchdogRun (which relies on the scheduler's run lock), this function acquires
 * and releases the run lock itself — a notifier run shares the same temp dir name
 * (`agentDir(wd.identity, true)`) as a regular run, and nothing else serializes the two. Refusal
 * to acquire is logged and treated as a no-op: the held-down state already means no regular runs
 * are in flight, so a collision is rare. Any other failure (including a timeout) is logged as a
 * warning and swallowed — a notifier failure must never throw into the scheduler loop.
 */
export declare function executeNotifierRun(wd: ResolvedWatchdog, text: string, deps: WatchdogRunDeps): Promise<void>;
/** What `_run-watchdog` calls: one supervised session, no cleanup — the parent harvests. */
export declare function runWatchdogAgent(name: string): Promise<void>;