import { type TSecretDelivery, type TSecretGeneratedEncoding, type IActiveSecretRecipientMetadata, type TSecretValueInput } from '../data/secret.js';
import { type IHostedAppRoleDefinition } from '../data/hostedapp.js';
import type { IServiceDomainRoute, IServicePublicPortMapping, IServiceTargetPort } from '../data/serviceports.js';
import type { IStorageCapacityRequest, IStorageClassRequirement, TFilesystemStorageAccessMode, TObjectStorageAccessMode, TObjectStorageDelivery, TStorageReclaimPolicy, TStorageResourceKind, TStorageSnapshotMode } from '../platform/storage.js';
export type TAppStorePlatformRequirement = 'mongodb' | 's3' | 'clickhouse' | 'valkey' | 'mariadb';
export interface IAppStorePlatformRequirements {
    mongodb?: boolean;
    /**
     * @deprecated `s3: true` is normalized to one legacy object-storage binding.
     * New templates use a named objectStorage request.
     */
    s3?: boolean;
    clickhouse?: boolean;
    valkey?: boolean;
    mariadb?: boolean;
}
export type TAppStoreSourceType = 'inline' | 'repoManifest' | 'dockerImage';
export type TAppStoreTrackingMode = 'tag' | 'digest';
export type TAppStoreUpgradeStrategy = 'semver' | 'branch' | 'dockerDigest';
export declare const appStoreStorageFeatureIds: {
    readonly bindingsV2: "storage.bindings.v2";
    readonly filesystemV1: "storage.filesystem.v1";
    readonly objectStorageV2: "storage.object-storage.v2";
    readonly objectStorageFileV2: "storage.object-storage.file.v2";
};
export type TAppStoreStorageFeatureId = typeof appStoreStorageFeatureIds[keyof typeof appStoreStorageFeatureIds];
export type TAppStoreStoragePurpose = 'runtime' | 'database' | 'registry' | 'backup';
/**
 * A template-local logical class. It states portable policy requirements and
 * preferences; fulfillment adapters select their own compatible policy class.
 */
export interface IAppStoreStorageClass {
    kind: TStorageResourceKind;
    purpose: TAppStoreStoragePurpose;
    required?: IStorageClassRequirement;
    preferred?: IStorageClassRequirement;
}
export interface IAppStoreStorageRequestBase {
    /** Stable identity used across upgrades, migrations, and restores. */
    id: string;
    kind: TStorageResourceKind;
    /** Key in the containing version config's storageClasses record. */
    storageClass: string;
    capacity?: IStorageCapacityRequest;
    reclaimPolicy: TStorageReclaimPolicy;
}
export interface IAppStoreFilesystemProtection {
    backup?: 'required';
    snapshots?: Exclude<TStorageSnapshotMode, 'none'>;
    consistency?: 'crashConsistent' | 'applicationConsistent';
}
export interface IAppStoreFilesystemStorageRequest extends IAppStoreStorageRequestBase {
    kind: 'filesystem';
    mountPath: string;
    accessMode: TFilesystemStorageAccessMode;
    protection?: IAppStoreFilesystemProtection;
}
export interface IAppStoreObjectStorageProtection {
    backup?: 'required';
    versioning?: 'required';
    /** Minimum provider-enforced retention duration. */
    retentionDays?: number;
}
export interface IAppStoreObjectStorageRequest extends IAppStoreStorageRequestBase {
    kind: 'objectStorage';
    accessMode: TObjectStorageAccessMode;
    delivery: TObjectStorageDelivery;
    protection?: IAppStoreObjectStorageProtection;
}
export type TAppStoreStorageRequest = IAppStoreFilesystemStorageRequest | IAppStoreObjectStorageRequest;
export interface IAppStoreInlineSource {
    type: 'inline';
}
export interface IAppStoreRepoManifestSource {
    type: 'repoManifest';
    /** Raw URL to a servezone.appstore.json file. Can point to a branch such as main. */
    url: string;
    /** Optional human-readable ref, for example main, stable, or v1.2.3. */
    ref?: string;
}
export interface IAppStoreDockerImageSource {
    type: 'dockerImage';
    /** Docker image reference. Mutable tags such as :latest are allowed when policy permits them. */
    image: string;
    /** Digest tracking turns mutable tag changes into explicit appstore upgrades. */
    tracking?: TAppStoreTrackingMode;
}
export type TAppStoreSource = IAppStoreInlineSource | IAppStoreRepoManifestSource | IAppStoreDockerImageSource;
export interface IAppStoreResolvedSource {
    type: TAppStoreSourceType;
    url?: string;
    ref?: string;
    image?: string;
    manifestHash?: string;
    imageDigest?: string;
    resolvedAt: string;
}
interface IAppStoreEnvironmentDeclarationBase {
    key: string;
    description: string;
    required?: boolean;
}
export interface IAppStorePublicEnvironmentDeclaration extends IAppStoreEnvironmentDeclarationBase {
    secret?: false;
    /** Public nonsecret default. */
    value?: string;
    delivery?: never;
    generate?: never;
}
export interface IAppStoreSecretEnvironmentDeclaration extends IAppStoreEnvironmentDeclarationBase {
    secret: true;
    value?: never;
    delivery: TSecretDelivery;
    generate?: {
        encoding: TSecretGeneratedEncoding;
        bytes: number;
    };
}
export type TAppStoreEnvironmentDeclaration = IAppStorePublicEnvironmentDeclaration | IAppStoreSecretEnvironmentDeclaration;
export interface IAppStoreVolume {
    /** Stable Docker volume name. If omitted, the runtime derives one from service name and mount path. */
    name?: string;
    /** Alias for name when a volume is shared intentionally across services. */
    source?: string;
    /** Container path where the volume is mounted. */
    mountPath: string;
    /** Docker volume driver. Defaults to the runtime's persistent volume driver. */
    driver?: string;
    readOnly?: boolean;
    /** Whether backup orchestration should snapshot this volume. Defaults to true. */
    backup?: boolean;
    /** Driver-specific options forwarded to the container runtime. */
    options?: Record<string, string>;
}
export type TAppStoreVolumeSpec = string | IAppStoreVolume;
export interface IAppStorePublishedPort {
    targetPort: number;
    targetPortEnd?: number;
    publishedPort?: number;
    publishedPortEnd?: number;
    protocol?: 'tcp' | 'udp';
    hostIp?: string;
}
export interface IAppStorePlatformOidcEnvironmentVariables {
    issuerUrl: string;
    clientId: string;
    /** The hosting platform must deliver this value through its secret environment path. */
    clientSecret: string;
    redirectUri: string;
    audience: string;
}
export interface IAppStorePlatformOidcCapability {
    /** Callback path relative to the app's canonical HTTPS origin. */
    redirectPath: string;
    roles: IHostedAppRoleDefinition[];
    environmentVariables: IAppStorePlatformOidcEnvironmentVariables;
    clientAuthenticationMethod: 'client_secret_basic' | 'client_secret_post';
}
export declare const validateAppStorePlatformOidcCapability: (capabilityArg: unknown) => string[];
export declare const validateAppStoreVersionPlatformOidc: (configArg: unknown) => string[];
export interface IAppStoreApp {
    id: string;
    name: string;
    description: string;
    category: string;
    iconName?: string;
    iconUrl?: string;
    latestVersion: string;
    versions?: string[];
    tags?: string[];
    channel?: string;
    upgradeStrategy?: TAppStoreUpgradeStrategy;
    source?: TAppStoreSource;
    /** Minimal runtime config for source-only appstore entries, typically dockerImage sources. */
    runtime?: IAppStoreVersionConfig;
    resolvedSource?: IAppStoreResolvedSource;
}
export interface IAppStoreIndex {
    schemaVersion: number;
    updatedAt: string;
    resolvedAt?: string;
    apps: IAppStoreApp[];
}
export interface IAppStoreAppMeta {
    id: string;
    name: string;
    description: string;
    category: string;
    iconName?: string;
    latestVersion: string;
    versions: string[];
    maintainer?: string;
    links?: Record<string, string>;
    tags?: string[];
    source?: TAppStoreSource;
    resolvedSource?: IAppStoreResolvedSource;
}
export interface IAppStoreVersionConfig {
    image: string;
    /** Legacy shorthand for targetPorts.web. New templates should prefer targetPorts. */
    port?: number;
    /** Exact OCI/Docker argument vector appended after the image entrypoint. */
    containerArgs?: string[];
    targetPorts?: IServiceTargetPort[];
    domains?: IServiceDomainRoute[];
    /** Edge/coretraffic public TCP/UDP exposure, distinct from Docker publishedPorts. */
    publicPortMappings?: IServicePublicPortMapping[];
    envVars?: TAppStoreEnvironmentDeclaration[];
    /**
     * @deprecated Legacy volume syntax. New templates use storageClasses and
     * storageRequests. Resolver normalization must reject legacy physical driver
     * options that cannot be represented portably.
     */
    volumes?: TAppStoreVolumeSpec[];
    /**
     * Template-local logical policy classes. Keys are stable within the
     * template; they are not Onebox or Cloudly operator class names.
     */
    storageClasses?: Record<string, IAppStoreStorageClass>;
    /** Stable named filesystem and managed object-storage requests. */
    storageRequests?: TAppStoreStorageRequest[];
    publishedPorts?: IAppStorePublishedPort[];
    platformRequirements?: IAppStorePlatformRequirements;
    /**
     * Declares that this workload can consume platform-managed OIDC. The host
     * still requires an explicit per-instance administrator toggle before it
     * creates a client, injects credentials, or emits app-scoped role claims.
     */
    platformOidc?: IAppStorePlatformOidcCapability;
    minOneboxVersion?: string;
    minCloudlyVersion?: string;
    appStoreVersion?: string;
    upgradeStrategy?: TAppStoreUpgradeStrategy;
    source?: TAppStoreSource;
    resolvedSource?: IAppStoreResolvedSource;
    resolvedImageDigest?: string;
    changelog?: string;
    breaking?: boolean;
    requiresManualReview?: boolean;
    migrationRequired?: boolean;
    backupBeforeUpgrade?: boolean;
    requiresFeatures?: string[];
    healthCheck?: {
        path?: string;
        port?: number;
        expectedStatus?: number;
    };
}
export interface IServezoneAppStoreAppInfo {
    id: string;
    name: string;
    description: string;
    category: string;
    iconName?: string;
    iconUrl?: string;
    tags?: string[];
    maintainer?: string;
    links?: Record<string, string>;
}
export interface IServezoneAppStoreVersion extends IAppStoreVersionConfig {
    version: string;
}
export interface IServezoneAppStoreManifest {
    schemaVersion: number;
    app: IServezoneAppStoreAppInfo;
    latestVersion?: string;
    channel?: string;
    channels?: Record<string, string>;
    source?: TAppStoreSource;
    runtime?: IAppStoreVersionConfig;
    versions?: IServezoneAppStoreVersion[];
    policy?: {
        allowMutableImage?: boolean;
        defaultChannel?: string;
    };
}
export interface IAppStoreInstallRequest {
    mutationId: string;
    appId: string;
    version: string;
    serviceId: string;
    serviceName: string;
    domain?: string;
    /** Legacy install-time override for the web target port. */
    port?: number;
    publishedPorts?: IAppStorePublishedPort[];
    publicPortMappings?: IServicePublicPortMapping[];
    publicEnvironment: Record<string, string>;
    secretInputs: Array<{
        key: string;
        valueInput: TSecretValueInput;
    }>;
}
export declare const validateAppStoreEnvironmentDeclarations: (declarationsArg: unknown) => string[];
export declare const validateAppStoreInstallRequest: (requestArg: unknown, configArg: IAppStoreVersionConfig, activeIngressRecipientArg: IActiveSecretRecipientMetadata) => Promise<string[]>;
export interface IUpgradeableAppStoreService {
    serviceId?: string;
    serviceName: string;
    appTemplateId: string;
    currentVersion: string;
    latestVersion: string;
    hasMigration: boolean;
}
export {};