import { type ApplyClient, type RemoteConnectorDefinition } from "./client.js";
import { type DesiredState } from "./desired-state.js";
import { type DiffPlan, type RemoteSnapshot } from "./diff.js";
interface ApplyOptions {
    cwd?: string;
    dryRun?: boolean;
    yes?: boolean;
    only?: "agents" | "memory";
    org?: string;
    url?: string;
    /** Bypass the project-link guard. */
    force?: boolean;
    /** Test seam — inject a stubbed fetch. */
    fetchImpl?: typeof fetch;
}
interface PendingAuthEntry {
    slug: string;
    kind: string;
    connectUrl?: string;
}
/**
 * Read a response body as a stream, counting *bytes* and aborting as soon as
 * the running total exceeds `maxBytes` — before buffering the rest. Decodes to
 * UTF-8 text only after the (bounded) body is in hand. Exported for testing.
 */
export declare function readBoundedBody(res: Response, maxBytes: number, onOverflow: () => never): Promise<string>;
/**
 * Validate connection / auth-profile config against the connector definitions
 * the server knows about. When `skipSchemaForConnectorKeys` is given, those
 * connector keys (the locally-declared `*.connector.ts` / `type: connector`
 * ones) get only the structural checks here — full JSON-schema validation runs
 * later, after install + catalog refetch, against the *fresh* schemas. This
 * avoids rejecting a connection's config against a stale installed schema when
 * the same apply updates that connector.
 */
interface ValidateConnectorStateOptions {
    /**
     * Connector keys whose JSON-schema validation should be skipped in this pass
     * (the locally-declared ones in the *pre*-install pass — they're schema-
     * validated post-install against the fresh catalog).
     */
    skipSchemaForConnectorKeys?: ReadonlySet<string>;
    /**
     * When true (the *post*-install pass), every connector key referenced by a
     * desired auth profile or connection must be present in the catalog with
     * `installed === true` — otherwise a hard `ValidationError` before any
     * `executePlan` mutation. Catches a typo'd `connector:` ref, or a local
     * `*.connector.ts` whose compiled `definition.key` differs from what the
     * manifest assumed (so it never got installed under the expected key).
     */
    requireInstalled?: boolean;
}
export declare function validateConnectorState(state: DesiredState, connectorDefinitions: RemoteConnectorDefinition[], opts?: ValidateConnectorStateOptions): string[];
export declare function locallyDeclaredConnectorKeys(state: DesiredState): Set<string>;
interface ApplyContext {
    client: ApplyClient;
    state: DesiredState;
    plan: DiffPlan;
    remote: RemoteSnapshot;
}
/**
 * Push provider API keys as org-shared `agent_secrets` rows so the worker can
 * inject them at runtime without a per-user auth profile. Idempotent (PUT):
 * same value → 200, different value → rotation. Walks all desired agents (not
 * just those with a settings diff) — the secret value isn't part of the
 * settings JSON, so a row can need a key even when every resource is noop (e.g.
 * first apply after the gateway picked up support, or a key-only `.env`
 * change/rotation). Callers invoke this AFTER executePlan (so a just-created
 * agent exists before its `/agents/<id>/providers/...` key push), and also in
 * the all-noop / key-only branch (no agent creates there). Kept outside
 * `executePlan` so both paths can call it without double-pushing.
 */
export declare function pushProviderApiKeys(client: ApplyClient, agents: DesiredState["agents"]): Promise<void>;
export declare function executePlan(ctx: ApplyContext, pendingAuth: PendingAuthEntry[]): Promise<void>;
export declare function applyCommand(opts?: ApplyOptions): Promise<void>;
export {};
//# sourceMappingURL=apply-cmd.d.ts.map