/** Canonical lower-case OCI sha256 digest. */
export type TSha256Digest = `sha256:${string}`;
export type TImageDeploymentPolicy = 'legacy-tag' | 'immutable-digest';
export type TOciManifestMediaType = 'application/vnd.oci.image.index.v1+json' | 'application/vnd.oci.image.manifest.v1+json' | 'application/vnd.docker.distribution.manifest.list.v2+json' | 'application/vnd.docker.distribution.manifest.v2+json';
export type TImmutableImageRolloutMode = 'promotion' | 'automatic' | 'rollback' | 'adoption';
export type TImmutableImageMismatchReason = 'immutable-plan-missing' | 'requested-digest-missing' | 'requested-digest-malformed' | 'registry-digest-inconsistent' | 'runtime-capability-missing' | 'pull-failed' | 'pulled-digest-missing' | 'pulled-digest-mismatch' | 'service-image-not-digest-pinned' | 'service-image-digest-mismatch' | 'task-image-not-digest-pinned' | 'task-image-digest-mismatch' | 'container-inspection-unavailable' | 'container-image-id-missing' | 'container-repodigest-missing' | 'container-repodigest-mismatch' | 'runtime-attestation-missing' | 'required-replica-missing'
/**
 * A replica exists and has not failed, but its health is not yet determined:
 * the in-process health prober starts every task at 'unknown' and escalates
 * to 'unhealthy' only after threshold failures against an established
 * /healthz contract. Undetermined is NOT unhealthy — this reason marks a
 * rollout that is still coming up inside its startup grace, so it maps to a
 * live status rather than a failure. Once the grace is exhausted the
 * shortfall is reported as 'replica-unhealthy'.
 */
 | 'replica-starting' | 'replica-unhealthy' | 'replica-failed' | 'stale-rollout-report' | 'rollback-target-not-accepted';
export type TRuntimeImageVerificationStatus = 'not-required' | 'pending' | 'verified' | 'missing' | 'mismatched';
export type TImmutableImageRolloutStatus = 'pending' | 'deploying' | 'verifying' | 'succeeded' | 'failed' | 'mismatched' | 'rolling-back' | 'rolled-back';
export interface ICoreflowRuntimeCapabilities {
    immutableImageDeploymentVersion: 1;
    /** Coreflow can answer the versioned, node-scoped Corestore inventory probe. */
    corestoreInventoryVersion?: 1;
    /** Coreflow can consume exact, cluster-scoped resolved secret manifests. */
    secretManifestVersion: 2;
    sealedSecretMaterialVersion: 1;
    secretRecipientEnrollmentVersion: 1;
    workloadInitEnvironmentVersion: 1;
    /** Coreflow can submit replay-safe schema-v1 secret deployment reports. */
    secretDeploymentReportVersion?: 1;
}
export type TImmutableContainerPlatform = 'linux/amd64' | 'linux/arm64';
export interface IImmutableContainerInvocationPlatformEvidenceV1 {
    platform: TImmutableContainerPlatform;
    platformManifestDigest: TSha256Digest;
    imageConfigDigest: TSha256Digest;
    /** Effective non-empty OCI argv after applying the deployment containerArgs. */
    effectiveArgv: string[];
}
export interface IImmutableContainerInvocationV1 {
    schemaVersion: 1;
    /** Sorted, unique, non-empty and limited to the authoritative platform union. */
    targetPlatforms: TImmutableContainerPlatform[];
    /** The one effective argv shared by every target platform. */
    argv: string[];
    /** Sorted exact one-to-one platform evidence. */
    evidence: IImmutableContainerInvocationPlatformEvidenceV1[];
    digest: TSha256Digest;
}
/**
 * A registry manifest observed by Cloudly. Observation alone does not make the
 * release deployable: acceptedAt is set only by an explicit promotion or a
 * configured automatic promotion.
 */
export interface IImageRelease {
    id: string;
    data: {
        serviceId: string;
        imageId: string;
        registryHost: string;
        repository: string;
        /** Digest of the registry root descriptor, preserving an index/list when submitted. */
        registryRootDigest: TSha256Digest;
        digestPinnedImageReference: string;
        manifestMediaType: TOciManifestMediaType;
        observedTags: string[];
        firstObservedAt: number;
        lastObservedAt: number;
        observationCount: number;
        /** Cloudly-created evidence from an authenticated exact-tag registry PUT. */
        trustedEvidence: IImageReleaseTrustedEvidence[];
        acceptedAt?: number;
        lastPromotedAt?: number;
        promotionCount?: number;
    };
}
export interface IImageReleaseTrustedEvidence {
    source: 'cloudly-registry';
    /** Deterministic ID for an authenticated registry acceptance event/retry. */
    evidenceId: string;
    operationId: string;
    actorUserId: string;
    registryHost: string;
    repository: string;
    tag: string;
    registryRootDigest: TSha256Digest;
    manifestMediaType: TOciManifestMediaType;
    recordedAt: number;
}
export declare const selectTrustedImageReleaseEvidence: (argsArg: {
    release: IImageRelease;
    operationId: string;
    actorUserId: string;
    serviceId: string;
    imageId: string;
    registryHost: string;
    repository: string;
    tag: string;
    digest: TSha256Digest;
}) => {
    evidence?: IImageReleaseTrustedEvidence;
    errors: string[];
};
export declare const normalizeImmutableReleaseTag: (tagArg: unknown) => string | undefined;
export interface IImmutableImageTargetScope {
    targetClusterIds: string[];
    targetNodeNames: string[];
    replicasPerNode: number;
    requiredReplicaCount: number;
}
/** Immutable desired state issued by Cloudly and consumed by Coreflow. */
export interface IImmutableImageDeploymentPlan {
    policy: 'immutable-digest';
    rolloutId: string;
    rolloutGeneration: number;
    releaseId: string;
    operationId: string;
    releaseTag: string;
    registryHost: string;
    repository: string;
    requestedDigest: TSha256Digest;
    digestPinnedImageReference: string;
    manifestMediaType: TOciManifestMediaType;
    /** Mandatory immutable command/config evidence for every target platform. */
    containerInvocation: IImmutableContainerInvocationV1;
    createdAt: number;
    mode: TImmutableImageRolloutMode;
    /** Full pre-adoption service configuration fence, required only for adoption. */
    adoptionConfigurationDigest?: TSha256Digest;
    rollbackOfRolloutId?: string;
    targetScope: IImmutableImageTargetScope;
}
/** Runtime evidence collected from Docker service, task, container and image state. */
interface IRuntimeImageEvidenceBase {
    rolloutId?: string;
    rolloutGeneration?: number;
    expectedDigest?: TSha256Digest;
    serviceImageReference?: string;
    taskImageReference?: string;
    taskReportedDigest?: TSha256Digest;
    containerImageId?: string;
    containerConfigImageReference?: string;
    /** Digest observed from local Docker image state without implying rollout verification. */
    observedDigest?: TSha256Digest;
    resolvedDigest?: TSha256Digest;
    platformManifestDigest?: TSha256Digest;
    repoDigests?: string[];
    evidenceSource?: 'task-spec' | 'local-container-inspect';
    observedAt: number;
}
export interface IVerifiedRuntimeImageEvidence extends IRuntimeImageEvidenceBase {
    verificationStatus: 'verified';
    rolloutId: string;
    rolloutGeneration: number;
    expectedDigest: TSha256Digest;
    serviceImageReference: string;
    taskImageReference: string;
    taskReportedDigest: TSha256Digest;
    containerImageId: string;
    containerConfigImageReference: string;
    resolvedDigest: TSha256Digest;
    repoDigests: string[];
    evidenceSource: 'local-container-inspect';
    mismatchReason?: never;
}
export interface IUnverifiedRuntimeImageEvidence extends IRuntimeImageEvidenceBase {
    verificationStatus: 'missing' | 'mismatched';
    mismatchReason: TImmutableImageMismatchReason;
}
export interface IPendingRuntimeImageEvidence extends IRuntimeImageEvidenceBase {
    verificationStatus: 'pending' | 'not-required';
    mismatchReason?: never;
}
export type IRuntimeImageEvidence = IVerifiedRuntimeImageEvidence | IUnverifiedRuntimeImageEvidence | IPendingRuntimeImageEvidence;
/** Mandatory security envelope when reporting an immutable rollout. */
export interface IImmutableRolloutReportEnvelope {
    rolloutId: string;
    rolloutGeneration: number;
    reporterSessionId: string;
    reportSequence: number;
    reporterCapabilities: ICoreflowRuntimeCapabilities;
    reporterNodeIds: string[];
    reporterNodeNames: string[];
}
export interface IImageRolloutReporterStatus {
    reporterId: string;
    reporterSessionId: string;
    clusterId: string;
    reporterNodeNames: string[];
    rolloutId: string;
    rolloutGeneration: number;
    reportSequence: number;
    reportedAt: number;
    requiredReplicaCount: number;
    observedReplicaCount: number;
    healthyReplicaCount: number;
    verifiedReplicaCount: number;
    failedReplicaCount: number;
    mismatchReason?: TImmutableImageMismatchReason;
}
export interface IImageRolloutStatus {
    rolloutId: string;
    rolloutGeneration: number;
    expectedDigest: TSha256Digest;
    status: TImmutableImageRolloutStatus;
    requiredReplicaCount: number;
    observedReplicaCount: number;
    healthyReplicaCount: number;
    verifiedReplicaCount: number;
    failedReplicaCount: number;
    mismatchReason?: TImmutableImageMismatchReason;
    updatedAt: number;
    reporters: IImageRolloutReporterStatus[];
}
export declare const createImmutableContainerInvocationDigestInput: (invocationArg: Omit<IImmutableContainerInvocationV1, "digest"> | IImmutableContainerInvocationV1) => string;
export declare const computeImmutableContainerInvocationDigest: (invocationArg: Omit<IImmutableContainerInvocationV1, "digest"> | IImmutableContainerInvocationV1) => Promise<TSha256Digest>;
export declare const verifyImmutableContainerInvocationDigest: (invocationArg: IImmutableContainerInvocationV1) => Promise<boolean>;
export declare const validateImmutableContainerInvocation: (invocationArg: unknown) => string[];
export declare const normalizeSha256Digest: (digest: unknown) => TSha256Digest | undefined;
export declare const isSha256Digest: (digest: string) => digest is TSha256Digest;
export declare const buildDigestPinnedImageReference: (registryHost: string, repository: string, digest: TSha256Digest) => string;
export declare const getDigestFromPinnedImageReference: (imageReference: string) => TSha256Digest | undefined;
export declare const validateImmutableImageDeploymentPlan: (planArg: IImmutableImageDeploymentPlan) => string[];
/** Coreflow uses this async verifier before resolving or opening secret material. */
export declare const verifyImmutableImageDeploymentPlan: (planArg: IImmutableImageDeploymentPlan) => Promise<boolean>;
export declare const validateImageRolloutStatus: (statusArg: IImageRolloutStatus) => string[];
export {};