import { AgentProfile } from '@tangle-network/sandbox';
import { AsyncAttestationPolicy, AttestationVerificationResult } from '@tangle-network/tcloud-attestation';

/**
 * GPU / accelerator request, mirroring `@tangle-network/sandbox`'s
 * `SandboxResources.accelerator` shape (that type is not re-exported from the
 * SDK's public entry, so we declare the structural shape here and forward it
 * verbatim). `kind` is the accelerator class (e.g. 'nvidia-a100'); `count`
 * defaults to 1; `memoryMB` is a minimum device-memory floor when the exact
 * class is flexible.
 */
interface SandboxAccelerator {
    kind: string;
    count?: number;
    memoryMB?: number;
}

type TCloudSandboxTee = 'any' | 'tdx' | 'nitro' | 'sev-snp' | 'phala-dstack' | 'gcp' | 'azure' | (string & {});
interface TCloudSandboxCreateOptions {
    name?: string;
    image?: string;
    environment?: string;
    ssh?: boolean;
    cpu?: number;
    memoryMb?: number;
    diskGb?: number;
    /**
     * GPU / accelerator request for heavy compute workloads (CFD, FEA, PDE,
     * MD, training). Forwarded verbatim to the underlying `@tangle-network/
     * sandbox` `CreateSandboxOptions.resources.accelerator`, which the fleet
     * autoscaler uses to provision a GPU-class host. `{ kind, count?, memoryMB? }`
     * — e.g. `{ kind: 'nvidia-a100', count: 1 }`. Omit for CPU-only sandboxes.
     */
    accelerator?: SandboxAccelerator;
    gitUrl?: string;
    gitRef?: string;
    backend?: 'opencode' | 'claude-code' | 'codex' | 'amp' | (string & {});
    /**
     * Declarative agent profile rendered into `backend.profile` on the
     * underlying `@tangle-network/sandbox` `CreateSandboxOptions`. The
     * profile carries the harness's prompt, tool allowlist, MCP servers
     * to attach, and subagents available for dispatch — everything a
     * coding-agent backend needs to specialize.
     *
     * When set alongside `backend` (string), `backend.type` becomes the
     * type and the profile rides as `backend.profile`. When `backend` is
     * omitted, the SDK applies its default type and consumes the profile
     * as-is.
     *
     * Confidential execution: if `agentProfile.confidential` is set AND
     * `tee` is also requested at the top level, the top-level `tee`
     * wins (it's the explicit op-level requirement). Set one or the
     * other, not both. The SDK fails closed when the operator cannot
     * satisfy the requested TEE.
     */
    agentProfile?: AgentProfile;
    tee?: TCloudSandboxTee;
    sealed?: boolean;
    attestationNonce?: string | 'auto';
    verify?: boolean;
    attestationPolicy?: Omit<AsyncAttestationPolicy, 'expectedNonce'>;
}
interface TCloudSandboxAttestationStatus {
    requested: boolean;
    evidenceReturned: boolean;
    verified: boolean;
    nonceBound: boolean;
    errors: string[];
}
interface TCloudSandboxCreateResult {
    sandbox: unknown;
    attestation?: unknown;
    verification?: AttestationVerificationResult;
    attestationNonce?: string;
    attestationStatus: TCloudSandboxAttestationStatus;
}
interface TCloudTeeAttestationChallenge {
    nonce: string;
    randomHex: string;
    contextHashHex?: string;
}
interface TCloudTeeAttestationHeartbeatSample {
    sequence: number;
    nonce: string;
    context: string;
    attestation: unknown;
    verification: AttestationVerificationResult;
    checkedAt: Date;
}
interface TCloudTeeAttestationHeartbeatOptions {
    tee?: TCloudSandboxTee;
    intervalMs?: number;
    signal?: AbortSignal;
    immediate?: boolean;
    continueOnFailure?: boolean;
    sessionId?: string;
    attestationPolicy?: Omit<AsyncAttestationPolicy, 'expectedNonce'>;
    onSuccess?: (sample: TCloudTeeAttestationHeartbeatSample) => void;
    onFailure?: (error: unknown) => void;
}
interface TCloudTeeAttestationHeartbeat {
    stop(): void;
    ping(context?: string): Promise<TCloudTeeAttestationHeartbeatSample>;
    readonly stopped: boolean;
    readonly failures: number;
    readonly latest: TCloudTeeAttestationHeartbeatSample | undefined;
    readonly done: Promise<void>;
}
interface TCloudSandboxConfig {
    apiKey: string;
    baseUrl?: string;
    timeoutMs?: number;
}
declare class TCloudSandbox {
    private readonly client;
    private readonly apiKey;
    private readonly baseUrl;
    private readonly timeoutMs;
    constructor(config: TCloudSandboxConfig);
    create(options: TCloudSandboxCreateOptions): Promise<TCloudSandboxCreateResult>;
    private attachTeeApiFallbacks;
    private fetchTeeAttestation;
    private fetchTeePublicKey;
    private fetchSandboxApi;
}
declare function createTeeAttestationChallenge(context?: string | Uint8Array): TCloudTeeAttestationChallenge;
declare function startTeeAttestationHeartbeat(sandbox: unknown, options?: TCloudTeeAttestationHeartbeatOptions): TCloudTeeAttestationHeartbeat;
declare function buildSandboxCreateOptions(options: TCloudSandboxCreateOptions): any;
declare function shouldVerifyAttestation(options: Pick<TCloudSandboxCreateOptions, 'tee' | 'verify'>): boolean;
declare function generateAttestationNonce(bytes?: number): string;

export { type SandboxAccelerator, TCloudSandbox, type TCloudSandboxAttestationStatus, type TCloudSandboxConfig, type TCloudSandboxCreateOptions, type TCloudSandboxCreateResult, type TCloudSandboxTee, type TCloudTeeAttestationChallenge, type TCloudTeeAttestationHeartbeat, type TCloudTeeAttestationHeartbeatOptions, type TCloudTeeAttestationHeartbeatSample, buildSandboxCreateOptions, createTeeAttestationChallenge, generateAttestationNonce, shouldVerifyAttestation, startTeeAttestationHeartbeat };