import { GitHubClient, GitHubClientOptions, createGitHubClient } from "@theholocron/github-client";
import { Auth, AuthError, Ci, CiRun, CiRunFilter, Environment, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, PagesConfig, PullRequest, RepoRef, RepoSettings, ResolveTokenInput, Ruleset, SecretScope, Secrets, Source, TeamEntry, TeamEntry as TeamEntry$1, TeamPermission, TrackerDoctorReport, TrackerUser, createFeatureResolver } from "@theholocron/cli";
//#region src/auth.d.ts
declare const resolveReadToken: (input?: ResolveTokenInput) => string;
declare const resolveIssuesToken: (input?: ResolveTokenInput) => string;
declare const resolveSyncToken: (input?: ResolveTokenInput) => string;
declare const resolveReleaseToken: (input?: ResolveTokenInput) => string;
declare const resolveAdminToken: (input?: ResolveTokenInput) => string;
declare const resolveDeployToken: (input?: ResolveTokenInput) => string;
declare const resolveOrgToken: (input?: ResolveTokenInput) => string;
//#endregion
//#region src/capabilities/ci.d.ts
interface CiOptions {
  repo: string;
}
declare class GitHubCi implements Ci {
  private readonly client;
  private readonly opts;
  readonly key: "ci";
  readonly providerName = "github";
  constructor(client: GitHubClient, opts: CiOptions);
  listRuns(filter?: CiRunFilter): Promise<CiRun[]>;
  getRun(id: string | number): Promise<CiRun>;
  private mapRun;
  private mapConclusion;
}
//#endregion
//#region src/capabilities/environments.d.ts
interface EnvironmentsOptions {
  repo: string;
}
declare class GitHubEnvironments implements Environments {
  private readonly client;
  private readonly opts;
  readonly key: "environments";
  readonly providerName = "github";
  constructor(client: GitHubClient, opts: EnvironmentsOptions);
  listEnvironments(): Promise<Environment[]>;
  upsertEnvironment(env: Environment): Promise<void>;
  deleteEnvironment(name: string): Promise<void>;
  private flattenReviewers;
}
//#endregion
//#region src/capabilities/issues.d.ts
interface IssuesOptions {
  repo: string;
  /**
   * Lifecycle slot → status label name. Optional at construction; if
   * omitted, capability methods that need labels (`transition`,
   * `doctor`) degrade gracefully — `transition` throws a clear error,
   * `doctor` reports the two label-backed slots as unresolved.
   */
  labels?: {
    inProgress: string;
    inReview: string;
  };
}
declare class GitHubIssues implements Issues {
  private readonly client;
  readonly key: "issues";
  readonly providerName = "github";
  private readonly owner;
  private readonly repoName;
  private readonly repo;
  private readonly labels;
  constructor(client: GitHubClient, opts: IssuesOptions);
  getMyself(): Promise<TrackerUser>;
  search(filter: IssueSearchFilter): Promise<Issue[]>;
  get(key: string): Promise<Issue>;
  create(input: {
    summary: string;
    body?: string;
    labels?: string[];
    milestone?: string;
  }): Promise<{
    key: string;
  }>;
  transition(key: string, slot: LifecycleSlot): Promise<LifecycleResult>;
  comment(key: string, body: string): Promise<void>;
  doctor(): Promise<TrackerDoctorReport>;
  private resolveMilestone;
  private removeStatusLabels;
  private mapIssue;
}
//#endregion
//#region src/capabilities/labels.d.ts
interface CanonicalLabel {
  readonly name: string;
  readonly color: string;
  readonly description: string;
}
/**
 * Idempotently synchronise a repo's labels to the canonical set.
 *
 * - Creates labels that are missing.
 * - PATCHes labels whose color or description has drifted.
 * - DELETEs labels listed in `stale`.
 * - Leaves unrecognised labels that aren't in `stale` untouched.
 */
declare function syncLabels(client: GitHubClient, repo: string, canonical: ReadonlyArray<CanonicalLabel>, stale: ReadonlyArray<string>): Promise<string>;
//#endregion
//#region src/capabilities/secrets.d.ts
interface SecretsOptions {
  repo: string;
}
declare class GitHubSecrets implements Secrets {
  private readonly client;
  private readonly opts;
  readonly key: "secrets";
  readonly providerName = "github";
  constructor(client: GitHubClient, opts: SecretsOptions);
  listSecrets(scope: SecretScope): Promise<string[]>;
  setSecret(scope: SecretScope, name: string, value: string): Promise<void>;
  deleteSecret(scope: SecretScope, name: string): Promise<void>;
}
//#endregion
//#region src/capabilities/source.d.ts
interface SourceOptions {
  repo: string;
  repoRoot: string;
  /** Secondary client authenticated with HOLOCRON_ORG_TOKEN for org-scoped operations (teams, custom properties). */
  orgClient?: GitHubClient;
  /** Forwarded to a secondary client created for Pages calls (HOLOCRON_DEPLOY_TOKEN). */
  baseUrl?: string;
  fetch?: typeof fetch;
}
declare class GitHubSource implements Source {
  private readonly client;
  readonly key: "source";
  readonly providerName = "github";
  private readonly owner;
  private readonly name;
  private readonly repo;
  private readonly repoRoot;
  private readonly workflowDir;
  private readonly orgClient?;
  private readonly baseUrl?;
  private readonly fetchImpl?;
  constructor(client: GitHubClient, opts: SourceOptions);
  whoami(): Promise<{
    login: string;
  }>;
  getRepo(): Promise<RepoRef>;
  listRulesets(): Promise<Ruleset[]>;
  createRuleset(payload: Record<string, unknown>): Promise<Ruleset>;
  updateRuleset(id: number, payload: Record<string, unknown>): Promise<Ruleset>;
  updateRepoSettings(settings: RepoSettings): Promise<void>;
  protectBranch(branch: string, payload: Record<string, unknown>): Promise<void>;
  enableVulnerabilityAlerts(): Promise<void>;
  enableAutomatedSecurityFixes(): Promise<void>;
  enableSecretScanning(): Promise<void>;
  enableCodeScanning(): Promise<string>;
  disableDefaultCodeScanning(): Promise<void>;
  enableDependencyGraph(): Promise<void>;
  enablePrivateVulnerabilityReporting(): Promise<void>;
  listWorkflowFiles(): Promise<string[]>;
  readWorkflowFile(name: string): Promise<string | null>;
  writeWorkflowFile(name: string, contents: string): Promise<void>;
  removeWorkflowFile(name: string): Promise<void>;
  writeRepoFile(path: string, contents: string): Promise<void>;
  syncLabels(canonical: ReadonlyArray<LabelDef>, stale: ReadonlyArray<string>): Promise<string>;
  syncProperties(values: Record<string, string>): Promise<string>;
  syncTeams(teams: TeamEntry$1[]): Promise<string>;
  syncTopics(topics: string[]): Promise<string>;
  syncDescription(description: string): Promise<string>;
  syncHomepage(homepage: string): Promise<string>;
  getPullRequest(number: number, repo?: string): Promise<PullRequest>;
  configurePages(config: PagesConfig, token: string): Promise<void>;
}
//#endregion
//#region src/capabilities/teams.d.ts
interface NormalizedTeamEntry {
  slug: string;
  permission: TeamPermission;
}
declare function normalizeTeamEntry(entry: TeamEntry): NormalizedTeamEntry;
declare function syncTeams(client: GitHubClient, repo: string, teams: TeamEntry[]): Promise<string>;
//#endregion
//#region src/sodium.d.ts
/**
 * Encrypt `value` for the given GitHub-provided base64 public key.
 * Returns the base64 ciphertext to send as `encrypted_value`.
 */
declare function encryptSecret(publicKeyBase64: string, value: string): Promise<string>;
//#endregion
//#region src/verify-token.d.ts
/**
 * `verifyToken` — plugin-level export used by `holocron auth set` +
 * `holocron auth check`. Hits `GET /user` and translates the response
 * into the normalized `VerifyTokenResult` shape.
 *
 * Kept as a standalone function (not a capability method) so the auth
 * command can call it without initializing the full plugin — plugin
 * construction requires an already-resolved token, which is exactly
 * what we don't have yet at bootstrap time.
 */
interface VerifyTokenSuccess {
  ok: true;
  subject: string;
}
interface VerifyTokenFailure {
  ok: false;
  message: string;
}
type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
interface VerifyTokenOptions {
  baseUrl?: string;
  fetch?: typeof fetch;
}
declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult>;
//#endregion
//#region src/index.d.ts
interface GitHubPluginOptions extends ResolveTokenInput {
  /** "owner/name" — e.g., "theholocron/holocron". Required. */
  repo: string;
  /** Absolute path to the working repo root. Used by `source`'s
   * workflow-file methods. Defaults to `process.cwd()`. */
  repoRoot?: string;
  /** Lifecycle slot → label name. Used by the `issues` capability. */
  labels?: {
    inProgress: string;
    inReview: string;
  };
  /** Override base URL for tests. Defaults to https://api.github.com. */
  baseUrl?: string;
  /** Override `fetch` for tests. Defaults to global `fetch`. */
  fetch?: typeof fetch;
}
interface PluginContext {
  options: GitHubPluginOptions;
  client: GitHubClient;
  repo: string;
  repoRoot: string;
}
declare function source(ctx: PluginContext, orgClient?: GitHubClient): Source;
declare function secrets(ctx: PluginContext): Secrets;
declare function environments(ctx: PluginContext): Environments;
declare function ci(ctx: PluginContext): Ci;
declare function issues(ctx: PluginContext): Issues;
declare function createPlugin(options: GitHubPluginOptions): {
  name: string;
  capabilities: {
    source: () => Source;
    ci: () => Ci;
    secrets: () => Secrets;
    environments: () => Environments;
    issues: () => Issues;
  };
};
/**
 * One-line hint printed by `holocron auth set github` when no token
 * is supplied or the supplied token is rejected.
 */
declare const AUTH_HINT: string;
//#endregion
export { AUTH_HINT, type Auth, AuthError, type CanonicalLabel, GitHubCi, type GitHubClientOptions, GitHubEnvironments, GitHubIssues, GitHubPluginOptions, GitHubSecrets, GitHubSource, type NormalizedTeamEntry, PluginContext, type ResolveTokenInput, type TeamEntry, type TeamPermission, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, ci, createFeatureResolver, createGitHubClient, createPlugin, encryptSecret, environments, issues, normalizeTeamEntry, resolveAdminToken, resolveDeployToken, resolveIssuesToken, resolveOrgToken, resolveReadToken, resolveReleaseToken, resolveSyncToken, secrets, source, syncLabels, syncTeams, verifyToken };