import type { IDeploymentPreflightProposedConfiguration, IDeploymentPreflightRuntimeTask } from './deploymentpreflight.js';
import type { IGatewayRouteDnsResult } from './gateway.js';
import type { IImageRolloutStatus, IImmutableImageDeploymentPlan, TSha256Digest } from './immutableimage.js';
import type { IRegistryTarget } from './registry.js';
import type { TServiceTargetPortRef } from './serviceports.js';
export type TDeploymentOperationMode = 'existing-service' | 'greenfield';
export type TDeploymentOperationPhase = 'reserve' | 'promote' | 'route';
interface IDeploymentReservationInputBase {
    organizationId: string;
    serviceId: string;
    idempotencyKey: string;
    sourceRevision: string;
    version: string;
    intentDigest: TSha256Digest;
    proposedConfiguration: IDeploymentPreflightProposedConfiguration;
    releaseTag: string;
    routes: IDeploymentRouteRequest[];
}
export interface IExistingServiceDeploymentReservationInput extends IDeploymentReservationInputBase {
    mode: 'existing-service';
    expectedRolloutGeneration: number;
    expectedCurrentRolloutId?: string;
}
export interface IGreenfieldServiceDeploymentReservationInput extends IDeploymentReservationInputBase {
    mode: 'greenfield';
    expectedRolloutGeneration?: never;
    expectedCurrentRolloutId?: never;
}
export type IDeploymentReservationInput = IExistingServiceDeploymentReservationInput | IGreenfieldServiceDeploymentReservationInput;
export type TDeploymentOperationState = 'reserving' | 'reserved' | 'provisioning' | 'awaiting-image' | 'image-recorded' | 'promoting-image' | 'rolling-out' | 'ready-for-route' | 'promoting-route' | 'verifying-route' | 'succeeded' | 'rolling-back' | 'rolled-back' | 'failed' | 'cleaning' | 'cleaned';
export interface IDeploymentRouteRequest {
    hostname: string;
    targetPort: Extract<TServiceTargetPortRef, number>;
    /** Provider-specific desired DNS proxy state. Omission preserves legacy behavior. */
    proxied?: boolean;
    /** Required exact one-label hostname used to verify a wildcard route. */
    verificationHostname?: string;
    readinessPath?: string;
    expectedStatusCodes?: number[];
}
export interface IDeploymentRouteClaimTarget {
    hostname: string;
    bucketHostname: string;
    wildcard: boolean;
}
export declare const canonicalizeDeploymentHostname: (hostnameArg: unknown) => string | undefined;
/**
 * Wildcards match exactly one label. Exact siblings share a bucket document
 * but may coexist; a wildcard claim excludes every exact name in its bucket.
 */
export declare const getDeploymentRouteClaimTarget: (hostnameArg: string) => IDeploymentRouteClaimTarget | undefined;
export declare const getDeploymentRouteVerificationHostname: (routeArg: IDeploymentRouteRequest) => string | undefined;
export declare const normalizeDeploymentReadinessPath: (pathArg?: unknown) => string | undefined;
export declare const validateDeploymentProposedConfiguration: (configurationArg: unknown) => string[];
export declare const validateDeploymentReservationInput: (inputArg: unknown) => string[];
interface IDeploymentRouteVerificationEvidenceBase {
    hostname: string;
    url: string;
    checkedAt: number;
    resolvedAddresses: string[];
    rolloutId: string;
    rolloutGeneration: number;
    expectedDigest: TSha256Digest;
    gatewayDns?: IGatewayRouteDnsResult;
    verificationAttemptCount?: number;
    verificationStartedAt?: number;
}
export interface IDeploymentRouteVerificationSuccessEvidence extends IDeploymentRouteVerificationEvidenceBase {
    outcome: 'succeeded';
    tls: {
        authorized: true;
        servername: string;
        subjectAlternativeNames: string[];
        validFrom?: string;
        validTo?: string;
    };
    http: {
        statusCode: number;
        redirected: false;
    };
    readiness: {
        path: string;
        expectedStatusCodes: number[];
        ready: true;
    };
}
export interface IDeploymentRouteVerificationFailureEvidence extends IDeploymentRouteVerificationEvidenceBase {
    outcome: 'failed';
    stage: 'dns' | 'address-policy' | 'connect' | 'tls' | 'http' | 'readiness';
    code: string;
    message: string;
    tls?: IDeploymentRouteVerificationSuccessEvidence['tls'];
    http?: IDeploymentRouteVerificationSuccessEvidence['http'];
    readiness?: IDeploymentRouteVerificationSuccessEvidence['readiness'];
}
export type IDeploymentRouteVerificationEvidence = IDeploymentRouteVerificationSuccessEvidence | IDeploymentRouteVerificationFailureEvidence;
export interface IDeploymentOperationFailure {
    code: string;
    message: string;
    retryable: boolean;
    failedAt: number;
}
/**
 * Durable deployment fence. All state transitions compare-and-set both id and
 * revision. Claim keys are server-generated and never accepted as authority.
 */
export interface IServiceDeploymentOperation {
    id: string;
    revision: number;
    data: {
        mode: TDeploymentOperationMode;
        organizationId: string;
        serviceId: string;
        actorUserId: string;
        idempotencyKey: string;
        requestDigest: TSha256Digest;
        sourceRevision: string;
        version: string;
        intentDigest: TSha256Digest;
        configurationDigest: TSha256Digest;
        proposedConfiguration: IDeploymentPreflightProposedConfiguration;
        namespace: string;
        registryTarget: IRegistryTarget;
        releaseTag: string;
        routes: IDeploymentRouteRequest[];
        claimKeys: string[];
        state: TDeploymentOperationState;
        releaseId?: string;
        registryRootDigest?: TSha256Digest;
        rolloutId?: string;
        rolloutGeneration?: number;
        routeGeneration?: number;
        routeVerification?: IDeploymentRouteVerificationEvidence[];
        /**
         * Most recent failure record. Set when the operation fails and retained
         * as audit history through 'cleaning' and 'cleaned'; cleared only by a
         * forward transition such as a successful retry. A populated failure does
         * therefore NOT imply state === 'failed'.
         */
        failure?: IDeploymentOperationFailure;
        createdAt: number;
        updatedAt: number;
    };
}
export interface IServiceDeploymentStatus {
    operation: IServiceDeploymentOperation;
    imageDeployment?: IImmutableImageDeploymentPlan;
    imageRolloutStatus?: IImageRolloutStatus;
    runtimeTasks: IDeploymentRuntimeTaskEvidence[];
    routeVerification: IDeploymentRouteVerificationEvidence[];
    immutableRolloutSucceeded: boolean;
    runtimeDigestVerified: boolean;
    routeVerified: boolean;
    succeeded: boolean;
}
interface IDeploymentRuntimeTaskEvidenceBase extends Omit<IDeploymentPreflightRuntimeTask, 'verificationStatus' | 'observedDigest' | 'reportedDigest'> {
    rolloutId: string;
    rolloutGeneration: number;
    expectedDigest: TSha256Digest;
    observedAt: number;
}
export interface IVerifiedDeploymentRuntimeTaskEvidence extends IDeploymentRuntimeTaskEvidenceBase {
    verificationStatus: 'verified';
    observedDigest: TSha256Digest;
    reportedDigest: TSha256Digest;
}
export interface IUnverifiedDeploymentRuntimeTaskEvidence extends IDeploymentRuntimeTaskEvidenceBase {
    verificationStatus: 'missing' | 'mismatched';
    observedDigest?: TSha256Digest;
    reportedDigest?: TSha256Digest;
}
export type IDeploymentRuntimeTaskEvidence = IVerifiedDeploymentRuntimeTaskEvidence | IUnverifiedDeploymentRuntimeTaskEvidence;
export {};