/**
 * Container scaler backend implementation.
 *
 * Manages ephemeral agent containers using Docker or Podman via dockerode.
 * Supports auto-detection of container runtime socket.
 * Handles full container lifecycle: pull, create, start, stop, remove.
 * Supports container socket sharing, resource limits, and orphan cleanup.
 */
import { type ToolRequirement } from '@kici-dev/shared';
import type { AgentTokenStore } from '../agent/token-store.js';
import type { ScalerBackend, ManagedAgent, LabelSetConfig, LogCapture, ResourceRequest, EffectiveLimits, SpawnContext, ScalerEventCallback, ValidationResult, ScalerEntry } from './types.js';
/**
 * Result of runtime detection.
 */
export interface DetectedRuntime {
    socketPath: string;
    runtime: 'docker' | 'podman';
}
/**
 * Probe known socket paths to detect which container runtime is available.
 * Returns the first accessible socket found, or null if none found.
 */
export declare function detectRuntime(runtimeHint?: 'docker' | 'podman' | 'auto'): Promise<DetectedRuntime | null>;
export interface ContainerScalerBackendOptions {
    /** Human-readable name for this scaler */
    name: string;
    /** Label sets this backend can provision */
    labelSets: LabelSetConfig[];
    /** Maximum concurrent agents */
    maxAgents: number;
    /** Container runtime host for remote connections (works for Docker and Podman remote) */
    host?: string;
    /** Explicit socket path (overrides auto-detection) */
    socketPath?: string;
    /** Runtime type hint: 'docker', 'podman', or 'auto' (default: 'auto') */
    runtime?: 'docker' | 'podman' | 'auto';
    /** Default resource limits applied when label set has none */
    defaultResources?: ResourceRequest;
    /** Extra host:IP mappings injected into spawned containers (e.g. ["verdaccio.local:host-gateway"]) */
    extraHosts?: string[];
    /** Disable nftables-based network isolation (default: true). Set to false when nft is unavailable (e.g. rootless containers without NET_ADMIN). */
    networkIsolation?: boolean;
    /** Token store for creating ephemeral agent auth tokens. Optional -- when undefined, no token is injected. */
    tokenStore?: AgentTokenStore;
    /** TTL for ephemeral agent tokens in ms. Default: 1 hour. */
    tokenTtlMs?: number;
    /** Agent roles for this scaler. undefined = all, [] = execution only. */
    roles?: string[];
}
export declare class ContainerScalerBackend implements ScalerBackend {
    readonly type: "container";
    readonly spawnsOnLocalHost: boolean;
    readonly maxAgents: number;
    private _labelSets;
    private readonly name;
    private readonly docker;
    private readonly defaultResources?;
    /** The resolved socket path (for socket sharing bind mounts) */
    private readonly resolvedSocketPath;
    /** The detected or configured runtime type */
    private readonly detectedRuntime;
    /** Extra host:IP mappings for spawned containers */
    private readonly extraHosts?;
    /** Whether nftables-based network isolation is enabled */
    private readonly networkIsolation;
    /** Token store for creating ephemeral agent auth tokens */
    private readonly tokenStore?;
    /** TTL for ephemeral agent tokens in ms */
    private readonly tokenTtlMs;
    /** Agent roles for this scaler. undefined = all, [] = execution only. */
    private readonly roles;
    /** ID of the isolated bridge network (set after creation/discovery) */
    private isolatedNetworkId;
    /** Host bridge interface name for the isolated network (used by nftables) */
    private isolatedBridgeIface;
    /** Tracks all managed agent containers by ManagedAgent.id */
    private readonly agents;
    /** Maps container ID to ManagedAgent.id for reverse lookup */
    private readonly containerToManaged;
    /** LogCapture instances for each managed agent (keyed by ManagedAgent.id) */
    private readonly logCaptures;
    /** Maps managedId → container IP on the isolated network (for per-container nftables cleanup) */
    private readonly containerIps;
    private constructor();
    /**
     * Ensure the isolated bridge network exists and nftables rules are applied.
     *
     * Creates `kici-agent-net` if it doesn't exist, inspects the network to
     * discover the host bridge interface name, then applies RFC1918 + metadata
     * blocking rules via nftables with a gateway exception.
     *
     * Idempotent: safe to call across orchestrator restarts.
     */
    private ensureIsolatedNetwork;
    /**
     * Declare required tools for a container scaler entry.
     *
     * For the auto-detect case (no explicit socketPath / remote host) the
     * orchestrator must have a local container runtime — docker OR podman — on
     * PATH, otherwise the scaler cannot spawn agent containers. Declaring it
     * here lets the startup tool-validation gate fail fast with a clear error
     * instead of the first job hanging. When a socketPath or remote host is
     * configured the binary need not be on PATH (the runtime may be remote), so
     * reachability is validated later in create().
     */
    static getRequiredTools(entry: ScalerEntry): ToolRequirement[];
    /**
     * Create a ContainerScalerBackend with auto-detected or configured socket.
     * Throws if no container runtime is found and no host is configured.
     */
    static create(options: ContainerScalerBackendOptions): Promise<ContainerScalerBackend>;
    /** Log source identifier: 'docker' or 'podman' based on detected runtime. */
    get logsSource(): string;
    get labelSets(): LabelSetConfig[];
    getActiveCount(): number;
    spawn(labelSet: string[], agentId: string, orchestratorUrl: string, onEvent?: ScalerEventCallback, effectiveLimits?: EffectiveLimits, spawnContext?: SpawnContext): Promise<ManagedAgent>;
    getScalerContext(agentId: string): Record<string, unknown> | undefined;
    destroy(managedId: string): Promise<void>;
    /**
     * Get the LogCapture for a managed agent (used by ScalerManager for log forwarding).
     */
    getLogCapture(managedId: string): LogCapture | undefined;
    shutdownAll(): Promise<void>;
    reload(labelSets: LabelSetConfig[]): ValidationResult;
    /**
     * Clean up orphaned kici-managed containers on startup.
     * Finds containers with the `kici-managed=true` label and removes them.
     * Returns the count of cleaned containers.
     */
    cleanupOrphans(): Promise<number>;
}
//# sourceMappingURL=container-backend.d.ts.map