/** Set the current number of active agents. */
export declare function setAgentsActive(value: number): void;
/** Set the current config version number. */
export declare function setConfigVersion(value: number): void;
/** Set the current number of stale runs detected. */
export declare function setStaleRunsCurrent(value: number): void;
interface ScalerUsageRow {
    scaler: string;
    machinePool?: string;
    cpus: number;
    memBytes: number;
}
/**
 * Replace the current scaler-usage breakdown.
 *
 * Called by ScalerManager whenever a reservation lands or releases. Caller is
 * responsible for including a `scaler="__global__"` row for the orchestrator-wide
 * total and one row per active machine pool (with `machinePool` set) reflecting
 * the on-disk ledger snapshot. Per-scaler rows omit `machinePool`.
 */
export declare function setScalerUsageBreakdown(rows: ScalerUsageRow[]): void;
/** Increment the spawn-refusal counter (called by ScalerManager when a request fails the cap check). */
export declare function incScalerSpawnRefusals(): void;
/**
 * Merge current per-label counts with explicit `0`s for previously-seen labels
 * whose queue has drained. Mutates `everSeen` to include the current labels.
 *
 * Exported for direct unit testing of the sticky-zero invariant: a label that
 * appears in one snapshot and is absent from the next must report `0` rather
 * than vanish, otherwise the by-label gauge series freezes at its last value.
 */
export declare function applyStickyQueueLabels(everSeen: Set<string>, byLabel: Record<string, number>): Record<string, number>;
/**
 * Update the dispatch-queue depth breakdown used by the Prometheus gauges.
 *
 * Called by the orchestrator's periodic depth refresher after polling the
 * JobQueue. Normalizes the input so the gauge callback can emit explicit
 * zero series for known statuses even when the queue is empty, and keeps
 * emitting `0` for any per-label series whose queue has drained.
 */
export declare function setDispatchQueueDepthBreakdown(snapshot: {
    byStatus: Partial<Record<'pending' | 'dispatched', number>>;
    byLabel: Record<string, number>;
}): void;
/**
 * Total webhooks received by the orchestrator.
 * Labels:
 * - source: relay (from Platform) | direct (webhook endpoint)
 * - event: GitHub event type (push, pull_request, etc.)
 */
export declare const webhooksReceivedTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total webhooks processed with outcome.
 * Labels:
 * - result: matched (triggered workflow) | skipped (no match) | error (processing failure)
 */
export declare const webhooksProcessedTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Duration of trigger matching operations (lock file evaluation).
 * Buckets: 1ms to 5s covering fast rejects through complex evaluations.
 */
export declare const triggerMatchDurationSeconds: import("@opentelemetry/api").Histogram<import("@opentelemetry/api").Attributes>;
/**
 * Total deduplication cache hits (duplicate webhooks rejected).
 */
export declare const dedupHitsTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * pg connection errors absorbed by the pool error handlers instead of
 * crashing the process (e.g. a database failover terminating idle pooled
 * backends).
 * Labels:
 * - source: idle-pool | client
 */
export declare const pgPoolClientErrorsTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total source cache hits (`.kici/` source tarball found for content hash).
 */
export declare const sourceCacheHitsTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total source cache misses (no source tarball cached for content hash).
 */
export declare const sourceCacheMissesTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total dep cache hits (dependency tarball found for lockfile hash).
 */
export declare const depCacheHitsTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total dep cache misses (no dependency tarball for lockfile hash).
 */
export declare const depCacheMissesTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Duration of build agent operations in seconds.
 * Tracks how long it takes to compile a workflow bundle via a build agent.
 * Buckets: 1s to 10min covering fast to slow compilations.
 */
export declare const buildDurationSeconds: import("@opentelemetry/api").Histogram<import("@opentelemetry/api").Attributes>;
/**
 * Total execution runs tracked.
 * Labels:
 * - status: running | success | failed | cancelled
 */
export declare const executionsTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Duration of execution runs in seconds.
 * Buckets: 1s to 30min covering fast to long pipelines.
 */
export declare const executionDurationSeconds: import("@opentelemetry/api").Histogram<import("@opentelemetry/api").Attributes>;
/**
 * Total steps executed.
 * Labels:
 * - status: running | success | failed | skipped
 */
export declare const stepsTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total GitHub check run API calls (create + update + stale_cleanup).
 * Labels:
 * - operation: create | update | stale_cleanup
 */
export declare const githubCheckRunTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total log chunks received from agents.
 */
export declare const logChunksReceivedTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total log bytes written to storage backend.
 */
export declare const logBytesStoredTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total number of scaler config reload operations.
 * Labels:
 * - result: attempted | success | failed
 */
export declare const scalerConfigReloadsTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * `bound` label for `kici_orch_scaler_spawn_failures_total`.
 * - `true`  — the failed spawn was bound to a queued job (a run is affected).
 * - `false` — a warm-pool / unbound pre-spawn (no run impact yet; fleet-health signal).
 */
export declare const ScalerSpawnFailureBound: {
    readonly Bound: "true";
    readonly Unbound: "false";
};
export type ScalerSpawnFailureBound = (typeof ScalerSpawnFailureBound)[keyof typeof ScalerSpawnFailureBound];
/**
 * Total scaler agent spawn failures.
 * Labels:
 * - backend: scaler backend type (bare-metal | container | firecracker | unknown)
 * - bound: true (job-bound spawn) | false (warm-pool/unbound)
 */
export declare const scalerSpawnFailuresTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total number of config reload operations.
 * Labels:
 * - result: success | failed | attempted
 * - source: sighup | http | cluster | cli
 */
export declare const configReloadTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total number of stale runs detected and marked as failed.
 */
export declare const staleRunsDetectedTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Time between job becoming stale and detection (seconds).
 * Buckets: 10s to 10min covering typical scan intervals.
 */
export declare const staleDetectionDurationSeconds: import("@opentelemetry/api").Histogram<import("@opentelemetry/api").Attributes>;
/**
 * Number of webhook-trigger registrations matched when an inbound generic
 * webhook fans out across sources in the same org.
 *
 * Recorded once per inbound webhook on the cross-source dispatch path
 * (including zero-match cases). The label carries the inbound event name
 * (NOT the literal 'generic_webhook').
 *
 * Buckets cover small fan-outs (1-2 typical) through large org-wide fan-outs.
 *
 * Labels:
 * - event: inbound event name (GitHub event type or generic webhook event)
 */
export declare const crossSourceFanoutSize: import("@opentelemetry/api").Histogram<import("@opentelemetry/api").Attributes>;
/**
 * Errors encountered during cross-source webhook dispatch.
 *
 * Labels:
 * - reason: 'clone_token' (issuance failed) | 'bundle_missing' (registration's
 *   provider bundle not found in registry)
 *
 * NOTE: dashboard panel for `kici_cross_source_errors_total` not yet added —
 * follow-up per .claude/rules/monitoring.md (out of scope for plan 28.4-02).
 */
export declare const crossSourceErrorsTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Counter for universal-git source registration errors at orchestrator
 * startup or config reload. A non-zero rate indicates at least one
 * `generic_webhook_sources` row with a non-null `git_config` could not be
 * promoted to a provider bundle — the row stays in the DB but its routing
 * key has no bundle, so webhooks for it will fall through to the generic
 * bundle's payload-only path.
 *
 * Labels:
 * - reason: 'invalid_config' (Zod parse failed) | 'bundle_build' (factory
 *   threw) | 'registration' (providerRegistry.registerByRoutingKey threw)
 */
export declare const universalGitRegistrationErrorsTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Counter for trust-resolution paths that were refused because the
 * numeric provider id was absent (on either side) or did not match an
 * identity link. Under the strict policy these refusals resolve the
 * contributor to `unknown` regardless of username overlap.
 *
 * Labels:
 * - reason: 'event_missing' (webhook payload had no sender.id) |
 *   'link_missing' (a username-matched link has provider_user_id NULL) |
 *   'id_mismatch' (a username-matched link has a different provider_user_id)
 */
export declare const trustMatchRefusedNoIdTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Internal events delivered to all matching workflows successfully (after the
 * lease commits processed=true).
 * Labels:
 * - event_name: the internal event name (GitHub event type or synthetic, e.g. workflow.rerun)
 */
export declare const eventDispatchSuccessTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Internal-event dispatch failures that triggered a retry (lease released,
 * next_retry_at scheduled).
 * Labels:
 * - event_name: the internal event name
 */
export declare const eventRetryTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Internal events moved to the DLQ after exhausting retries.
 * Labels:
 * - event_name: the internal event name
 * - reason: why the event was DLQ'd (exhausted_retries)
 */
export declare const eventDlqTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Dispatch leases that timed out before the holding node finalised them
 * (signals a node crash mid-dispatch). Emits no labels.
 */
export declare const eventLeaseExpirationsTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Distribution of dispatch attempts at terminal outcome (success or DLQ).
 * Labels:
 * - event_name: the internal event name
 * - result: terminal outcome of the dispatch (success | dlq)
 */
export declare const eventAttemptsHistogram: import("@opentelemetry/api").Histogram<import("@opentelemetry/api").Attributes>;
/** Set the current DLQ depth gauge. Refreshed by the leader-only retry scanner each tick. */
export declare function setEventDlqDepth(value: number): void;
/**
 * Reason values for the `kici_orch_install_secrets_decisions_total` counter.
 * The single source of truth — the resolver and tests both reference these
 * constants, so adding a new reject path requires extending the union here.
 */
export declare const InstallSecretsDecisionReason: {
    readonly Ok: "ok";
    readonly MalformedRef: "malformed_ref";
    readonly InvalidUrlScheme: "invalid_url_scheme";
    readonly MissingEnvStore: "missing_env_store";
    readonly MissingSecretResolver: "missing_secret_resolver";
    readonly EnvNotFound: "env_not_found";
    readonly ProtectionRuleBlock: "protection_rule_block";
    readonly MissingToken: "missing_token";
    readonly MissingInstallEnv: "missing_install_env";
};
export type InstallSecretsDecisionReason = (typeof InstallSecretsDecisionReason)[keyof typeof InstallSecretsDecisionReason];
/**
 * Channel label for `kici_orch_install_secrets_npm_registry_used_total`.
 * - `registries` is Option A (workflow-level `registries:` block).
 * - `install_env` is Option C (committed `.kici/.npmrc` + `installEnv:`).
 */
export declare const InstallSecretsChannel: {
    readonly Registries: "registries";
    readonly InstallEnv: "install_env";
};
export type InstallSecretsChannel = (typeof InstallSecretsChannel)[keyof typeof InstallSecretsChannel];
/**
 * Total install-secrets resolution decisions.
 *
 * Labels:
 * - decision: pass | reject
 * - reason: ok (only with `pass`), or one of the reject reasons enumerated in `InstallSecretsDecisionReason`
 *
 * Pass series are emitted exactly once per resolver call that does any work
 * (workflows declaring neither `registries:` nor `installEnv:` are NOT
 * counted — that's the trivial early-return path and dashboard rates would
 * be dominated by it).
 */
export declare const installSecretsDecisionsTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total registry / installEnv entries that successfully resolved on a
 * passing dispatch. Each entry contributes one increment, so a workflow
 * with two `registries:` rows and one `installEnv:` entry adds three.
 *
 * Labels:
 * - channel: registries (Option A workflow block) | install_env (Option C committed .npmrc + installEnv:)
 * - provider: static today (long-lived `tokenSecret`); reserved for the typed RegistryProvider (aws-codeartifact, gcp-artifact-registry, …) when that lands
 * - scope: the npm scope string like `@my-org`, the literal `default` for a no-scope default registry, or `-` for install_env entries (no scope concept on Option C)
 */
export declare const installSecretsRegistryUsedTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Total dispatches where the orchestrator stripped registry tokens because
 * the resolved contributor trust tier was not `trusted` (fork PRs from
 * unknown contributors). Defense-in-depth: even if a misconfigured
 * environment lacks a `minimum_trust` rule, this strip prevents tokens
 * from leaving the orchestrator for those dispatches.
 *
 * Labels:
 * - trust_tier: unknown | known (the `trusted` tier does not strip and therefore never fires this counter)
 */
export declare const installSecretsContributorStrippedTotal: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
/**
 * Per-environment latency of `secretResolver.resolveForJob` calls in the
 * install-secrets path. Buckets mirror `triggerMatchDurationSeconds`:
 * 1ms → 5s covers fast Postgres reads through pathological Vault timeouts.
 *
 * Labels:
 * - environment: the environment name referenced in the qualified `<environment>:<secret>` ref (per-org count is typically <10)
 */
export declare const installSecretsTokenResolutionDurationSeconds: import("@opentelemetry/api").Histogram<import("@opentelemetry/api").Attributes>;
export {};
//# sourceMappingURL=prometheus.d.ts.map