import { z } from 'zod';
/**
 * Target-artifact admission (plan Section 8). Every target plan that deploys
 * bytes binds one of these, and the identity is a pure function of the exact
 * transformation inputs: the source artifacts, the transformation contract,
 * the builder, the complete member inventory, the platforms, and the
 * normalized runtime declarations.
 *
 * Two consequences the plan makes load-bearing follow from that. Two builds of
 * the same admitted source reproduce the same `targetArtifactAdmissionId`,
 * because nothing else enters the preimage. And a partial directory hash or a
 * mutable tag can never be admitted, because `contentManifestHash` covers the
 * complete byte and member inventory and `byteLength` must equal what that
 * inventory sums to -- so a missing member fails admission rather than
 * producing a plausible different identity.
 *
 * Admission is credential free by construction: this module is in the neutral
 * package, which cannot reach a filesystem, a provider, or a registry.
 */
export declare const DappTargetArtifactAdmissionSchema: "network.xyo.dapp.target.artifact.admission" & {
    readonly __schema: true;
};
export declare const TargetArtifactKindZod: z.ZodEnum<{
    "oci-image": "oci-image";
    "vercel-output": "vercel-output";
    "cloudflare-worker-bundle": "cloudflare-worker-bundle";
    "proxmox-guest-workload": "proxmox-guest-workload";
}>;
export type TargetArtifactKind = z.infer<typeof TargetArtifactKindZod>;
/** The kinds MI5A admits: an edge bundle runs inside a provider runtime and has no guest of its own. */
export declare const EdgeTargetArtifactKinds: readonly TargetArtifactKind[];
/** The kinds MI5C admits: a workload runs as its own process, so it declares how to start and probe it. */
export declare const WorkloadTargetArtifactKinds: readonly TargetArtifactKind[];
export declare const AllTargetArtifactKinds: readonly TargetArtifactKind[];
/** One member of the complete inventory: an exact path, its digest, and its exact length. */
export declare const TargetArtifactMemberZod: z.ZodObject<{
    path: z.ZodString;
    sha256: z.ZodString;
    byteLength: z.ZodNumber;
}, z.core.$strict>;
export type TargetArtifactMember = z.infer<typeof TargetArtifactMemberZod>;
export declare function compareTargetArtifactMembers(left: TargetArtifactMember, right: TargetArtifactMember): number;
export declare function normalizeTargetArtifactMembers(members: readonly TargetArtifactMember[]): TargetArtifactMember[];
/**
 * The identity of the complete member inventory. It is taken over the sorted
 * inventory rather than the directory, so an omitted member changes it and a
 * reordered listing does not.
 */
export declare function hashTargetArtifactContentManifest(membersValue: unknown): string;
export declare const TargetArtifactSourceZod: z.ZodObject<{
    artifactId: z.ZodString;
    contentHash: z.ZodString;
}, z.core.$strict>;
export type TargetArtifactSource = z.infer<typeof TargetArtifactSourceZod>;
/** The transformation contract tuple, which must equal one entry of the adapter descriptor's `supportedContracts`. */
export declare const TargetTransformationContractZod: z.ZodObject<{
    schema: z.ZodString;
    schemaVersion: z.ZodNumber;
    schemaHash: z.ZodString;
}, z.core.$strict>;
export declare const TargetArtifactBuilderZod: z.ZodObject<{
    name: z.ZodString;
    version: z.ZodString;
    implementationHash: z.ZodString;
}, z.core.$strict>;
/** Nullable platform fields are explicit `null`, so an absent variant is never confused with an unstated one. */
export declare const TargetArtifactPlatformZod: z.ZodObject<{
    os: z.ZodEnum<{
        darwin: "darwin";
        linux: "linux";
        windows: "windows";
    }>;
    architecture: z.ZodEnum<{
        amd64: "amd64";
        arm64: "arm64";
    }>;
    variant: z.ZodNullable<z.ZodString>;
    libc: z.ZodNullable<z.ZodEnum<{
        glibc: "glibc";
        musl: "musl";
    }>>;
}, z.core.$strict>;
export type TargetArtifactPlatform = z.infer<typeof TargetArtifactPlatformZod>;
export declare function compareTargetArtifactPlatforms(left: TargetArtifactPlatform, right: TargetArtifactPlatform): number;
export declare const TargetArtifactContentZod: z.ZodObject<{
    mediaType: z.ZodString;
    contentDigest: z.ZodString;
    byteLength: z.ZodNumber;
    contentManifestHash: z.ZodString;
}, z.core.$strict>;
/**
 * Normalized, public-safe runtime declarations. The plan forbids any route,
 * credential, secret, grant, or host-private value here, so the shape admits
 * only the declarations a target needs to run and probe.
 */
export declare const TargetArtifactRuntimeZod: z.ZodObject<{
    entrypoint: z.ZodArray<z.ZodString>;
    ports: z.ZodArray<z.ZodObject<{
        name: z.ZodString;
        containerPort: z.ZodNumber;
        protocol: z.ZodEnum<{
            tcp: "tcp";
            udp: "udp";
        }>;
    }, z.core.$strict>>;
    health: z.ZodNullable<z.ZodObject<{
        path: z.ZodString;
        expectedStatus: z.ZodNumber;
    }, z.core.$strict>>;
    readiness: z.ZodNullable<z.ZodObject<{
        path: z.ZodString;
        expectedStatus: z.ZodNumber;
    }, z.core.$strict>>;
    bootstrap: z.ZodNullable<z.ZodObject<{
        contractId: z.ZodString;
        contractHash: z.ZodString;
    }, z.core.$strict>>;
}, z.core.$strict>;
export declare const DappTargetArtifactAdmissionV1PreimageZod: z.ZodObject<{
    schema: z.ZodLiteral<"network.xyo.dapp.target.artifact.admission" & {
        readonly __schema: true;
    }>;
    schemaVersion: z.ZodLiteral<1>;
    hashAlgorithm: z.ZodLiteral<"jcs-sha256-v1">;
    targetArtifactKind: z.ZodEnum<{
        "oci-image": "oci-image";
        "vercel-output": "vercel-output";
        "cloudflare-worker-bundle": "cloudflare-worker-bundle";
        "proxmox-guest-workload": "proxmox-guest-workload";
    }>;
    targetAdapterDescriptorHash: z.ZodString;
    sourceArtifacts: z.ZodArray<z.ZodObject<{
        artifactId: z.ZodString;
        contentHash: z.ZodString;
    }, z.core.$strict>>;
    transformationContract: z.ZodObject<{
        schema: z.ZodString;
        schemaVersion: z.ZodNumber;
        schemaHash: z.ZodString;
    }, z.core.$strict>;
    builder: z.ZodObject<{
        name: z.ZodString;
        version: z.ZodString;
        implementationHash: z.ZodString;
    }, z.core.$strict>;
    content: z.ZodObject<{
        mediaType: z.ZodString;
        contentDigest: z.ZodString;
        byteLength: z.ZodNumber;
        contentManifestHash: z.ZodString;
    }, z.core.$strict>;
    platforms: z.ZodArray<z.ZodObject<{
        os: z.ZodEnum<{
            darwin: "darwin";
            linux: "linux";
            windows: "windows";
        }>;
        architecture: z.ZodEnum<{
            amd64: "amd64";
            arm64: "arm64";
        }>;
        variant: z.ZodNullable<z.ZodString>;
        libc: z.ZodNullable<z.ZodEnum<{
            glibc: "glibc";
            musl: "musl";
        }>>;
    }, z.core.$strict>>;
    runtime: z.ZodObject<{
        entrypoint: z.ZodArray<z.ZodString>;
        ports: z.ZodArray<z.ZodObject<{
            name: z.ZodString;
            containerPort: z.ZodNumber;
            protocol: z.ZodEnum<{
                tcp: "tcp";
                udp: "udp";
            }>;
        }, z.core.$strict>>;
        health: z.ZodNullable<z.ZodObject<{
            path: z.ZodString;
            expectedStatus: z.ZodNumber;
        }, z.core.$strict>>;
        readiness: z.ZodNullable<z.ZodObject<{
            path: z.ZodString;
            expectedStatus: z.ZodNumber;
        }, z.core.$strict>>;
        bootstrap: z.ZodNullable<z.ZodObject<{
            contractId: z.ZodString;
            contractHash: z.ZodString;
        }, z.core.$strict>>;
    }, z.core.$strict>;
}, z.core.$strict>;
export type DappTargetArtifactAdmissionV1Preimage = z.infer<typeof DappTargetArtifactAdmissionV1PreimageZod>;
export declare const DappTargetArtifactAdmissionV1Zod: z.ZodObject<{
    schema: z.ZodLiteral<"network.xyo.dapp.target.artifact.admission" & {
        readonly __schema: true;
    }>;
    schemaVersion: z.ZodLiteral<1>;
    hashAlgorithm: z.ZodLiteral<"jcs-sha256-v1">;
    targetArtifactKind: z.ZodEnum<{
        "oci-image": "oci-image";
        "vercel-output": "vercel-output";
        "cloudflare-worker-bundle": "cloudflare-worker-bundle";
        "proxmox-guest-workload": "proxmox-guest-workload";
    }>;
    targetAdapterDescriptorHash: z.ZodString;
    sourceArtifacts: z.ZodArray<z.ZodObject<{
        artifactId: z.ZodString;
        contentHash: z.ZodString;
    }, z.core.$strict>>;
    transformationContract: z.ZodObject<{
        schema: z.ZodString;
        schemaVersion: z.ZodNumber;
        schemaHash: z.ZodString;
    }, z.core.$strict>;
    builder: z.ZodObject<{
        name: z.ZodString;
        version: z.ZodString;
        implementationHash: z.ZodString;
    }, z.core.$strict>;
    content: z.ZodObject<{
        mediaType: z.ZodString;
        contentDigest: z.ZodString;
        byteLength: z.ZodNumber;
        contentManifestHash: z.ZodString;
    }, z.core.$strict>;
    platforms: z.ZodArray<z.ZodObject<{
        os: z.ZodEnum<{
            darwin: "darwin";
            linux: "linux";
            windows: "windows";
        }>;
        architecture: z.ZodEnum<{
            amd64: "amd64";
            arm64: "arm64";
        }>;
        variant: z.ZodNullable<z.ZodString>;
        libc: z.ZodNullable<z.ZodEnum<{
            glibc: "glibc";
            musl: "musl";
        }>>;
    }, z.core.$strict>>;
    runtime: z.ZodObject<{
        entrypoint: z.ZodArray<z.ZodString>;
        ports: z.ZodArray<z.ZodObject<{
            name: z.ZodString;
            containerPort: z.ZodNumber;
            protocol: z.ZodEnum<{
                tcp: "tcp";
                udp: "udp";
            }>;
        }, z.core.$strict>>;
        health: z.ZodNullable<z.ZodObject<{
            path: z.ZodString;
            expectedStatus: z.ZodNumber;
        }, z.core.$strict>>;
        readiness: z.ZodNullable<z.ZodObject<{
            path: z.ZodString;
            expectedStatus: z.ZodNumber;
        }, z.core.$strict>>;
        bootstrap: z.ZodNullable<z.ZodObject<{
            contractId: z.ZodString;
            contractHash: z.ZodString;
        }, z.core.$strict>>;
    }, z.core.$strict>;
    targetArtifactAdmissionId: z.ZodString;
}, z.core.$strict>;
export type DappTargetArtifactAdmissionV1 = z.infer<typeof DappTargetArtifactAdmissionV1Zod>;
export declare function hashDappTargetArtifactAdmissionV1(preimage: unknown): string;
export declare function verifyDappTargetArtifactAdmissionV1(value: unknown): DappTargetArtifactAdmissionV1;
export interface AdmitTargetArtifactInput {
    readonly builder: z.infer<typeof TargetArtifactBuilderZod>;
    readonly contentDigest: string;
    readonly mediaType: string;
    /** The complete inventory. Admission fails if it does not account for every declared byte. */
    readonly members: readonly TargetArtifactMember[];
    readonly platforms: readonly TargetArtifactPlatform[];
    readonly runtime: z.infer<typeof TargetArtifactRuntimeZod>;
    readonly sourceArtifacts: readonly TargetArtifactSource[];
    readonly targetAdapterDescriptorHash: string;
    readonly targetArtifactKind: TargetArtifactKind;
    readonly transformationContract: z.infer<typeof TargetTransformationContractZod>;
}
export interface TargetArtifactAdmissionIssue {
    code: 'target-artifact.incomplete-inventory' | 'target-artifact.invalid' | 'target-artifact.unsupported-kind';
    message: string;
    path: (number | string)[];
}
export type AdmitTargetArtifactResult = {
    issues: TargetArtifactAdmissionIssue[];
    success: false;
} | {
    success: true;
    value: DappTargetArtifactAdmissionV1;
};
/**
 * Admits one target artifact from its complete inventory. The byte length is
 * derived from the members rather than declared, so an inventory that omits a
 * member cannot describe the same artifact: it either fails here or admits a
 * visibly different one. Nothing about the local filesystem, a provider, or a
 * registry enters this function.
 */
export declare function admitDappTargetArtifactV1(input: AdmitTargetArtifactInput, admittedKinds?: readonly TargetArtifactKind[]): AdmitTargetArtifactResult;
//# sourceMappingURL=targetArtifactAdmission.d.ts.map