import type { WorkerBundle } from './worker-template.js';
export declare const SHARE_LIFECYCLE_RULE_ID = "agents-share-expire-objects";
export declare const SHARE_LIFECYCLE_RETENTION_DAYS = 366;
interface R2LifecycleRule {
    id: string;
    enabled: boolean;
    conditions: {
        prefix: string;
    };
    deleteObjectsTransition?: {
        condition: {
            type: 'Age';
            maxAge: number;
        } | {
            type: 'Date';
            date: string;
        };
    };
    abortMultipartUploadsTransition?: {
        condition?: {
            type: 'Age';
            maxAge: number;
        };
    };
    storageClassTransitions?: Array<{
        condition: {
            type: 'Age';
            maxAge: number;
        } | {
            type: 'Date';
            date: string;
        };
        storageClass: 'InfrequentAccess';
    }>;
}
export interface CloudflareRequest {
    apiToken: string;
    method: string;
    pathname: string;
    body?: unknown;
    form?: FormData;
}
export type CloudflareRequester = <T = unknown>(request: CloudflareRequest) => Promise<T>;
interface ProvisionOptions {
    request?: CloudflareRequester;
}
/** Create the R2 bucket (idempotent). */
export declare function createBucket(apiToken: string, accountId: string, name: string, opts?: ProvisionOptions): Promise<void>;
export declare function buildShareLifecycleRule(days?: number): R2LifecycleRule;
export declare function mergeShareLifecycleRule(existing?: R2LifecycleRule[], rule?: R2LifecycleRule): R2LifecycleRule[];
/** Ensure the share bucket self-cleans old objects. Exact per-link expiry is enforced by the Worker. */
export declare function configureBucketLifecycle(apiToken: string, accountId: string, bucketName: string, opts?: ProvisionOptions): Promise<void>;
/** Upload the module Worker with an R2 binding (`BUCKET`). Secrets are set via the Workers Secrets API. */
export declare function deployWorker(apiToken: string, accountId: string, workerName: string, worker: string | WorkerBundle, bucketName: string, opts?: ProvisionOptions): Promise<void>;
/** sha256 of the rendered Worker script, so a deployed endpoint can be compared
 * against the current `worker-template.ts` without redeploying to find out. */
export declare function hashWorkerScript(script: string): string;
export interface UpdateWorkerResult {
    /** sha256 of `script` (the hash the endpoint now matches, whether or not this
     * call actually redeployed). */
    templateHash: string;
    /** True when the upload was skipped because `previousHash` already matched. */
    skipped: boolean;
}
/** Cloudflare `secret_text` name the Worker reads as `env.PHOENIX_ID_BASE`. */
export declare const WORKER_PHOENIX_ID_BASE_SECRET = "PHOENIX_ID_BASE";
export type UpdateWorkerOpts = ProvisionOptions & {
    force?: boolean;
    /**
     * Phoenix ID base URL to bind as `PHOENIX_ID_BASE` after the script upload.
     * Pass this for a managed deployment; omit it for a pure-BYO Worker (which
     * authenticates only via WRITE_TOKEN). An empty string is a caller bug and
     * fails loud — do not pass a blank to "skip".
     */
    phoenixIdBase?: string;
};
/**
 * Re-deploy the Worker script against an ALREADY-provisioned endpoint (same
 * account/worker/bucket `deployWorker` was first called with) and idempotently
 * no-op when the template hasn't changed.
 *
 * Cloudflare's script-upload endpoint (`deployWorker`, above) replaces the
 * Worker's bindings/secrets wholesale on every call — there is no documented,
 * reliable way to tell it "keep the existing secret" (the `keep_bindings`
 * metadata field some third-party guides mention is absent from Cloudflare's
 * current Multipart upload metadata reference, and the community has reported
 * it not preventing binding loss even when present:
 * https://developers.cloudflare.com/workers/configuration/multipart-upload-metadata/,
 * https://community.cloudflare.com/t/upload-worker-module-endpoint-removes-existing-bindings-despite-keep-bindings/766447).
 * So instead this immediately re-applies WRITE_TOKEN via the documented Secrets
 * API right after the upload — the same two-call sequence first-time
 * provisioning already uses (`deployWorker` then `setWorkerSecret`), except
 * `writeToken` here is the caller's EXISTING token, never a freshly generated
 * one. A managed deploy also re-applies `PHOENIX_ID_BASE` the same way (the
 * Worker reads it to verify Phoenix bearers); a pure-BYO deploy omits it.
 * Cloudflare's own docs describe exactly this "secrets survive a
 * subsequent write" contract for the sibling `wrangler versions upload
 * --secrets-file` flow ("Secrets not included in the file are preserved from
 * the previous version" —
 * https://developers.cloudflare.com/workers/configuration/secrets/#upload-secrets-alongside-code);
 * re-setting the secret to its own value after every deploy gets the same
 * outcome without depending on an unverified upload-time flag.
 */
export declare function updateWorker(apiToken: string, accountId: string, workerName: string, bucketName: string, worker: string | WorkerBundle, writeToken: string, previousHash: string | undefined, opts?: UpdateWorkerOpts): Promise<UpdateWorkerResult>;
/** Add/update a secret_text binding using Cloudflare's Workers Secrets API. */
export declare function putWorkerSecret(apiToken: string, accountId: string, workerName: string, name: string, text: string, opts?: ProvisionOptions): Promise<void>;
/** Add/update the WRITE_TOKEN binding using Cloudflare's Workers Secrets API. */
export declare function setWorkerSecret(apiToken: string, accountId: string, workerName: string, writeToken: string, opts?: ProvisionOptions): Promise<void>;
/** Enable the free `*.workers.dev` route for the script, and return the account subdomain. */
export declare function enableWorkersDev(apiToken: string, accountId: string, workerName: string, opts?: ProvisionOptions): Promise<string>;
/** Resolve a zone id for a domain the token can see, or null if not owned/visible. */
export declare function findZoneId(apiToken: string, domain: string, opts?: ProvisionOptions): Promise<string | null>;
/** Map a custom hostname (e.g. `share.getrush.ai`) to the Worker via Workers Custom Domains. */
export declare function addCustomDomain(apiToken: string, accountId: string, workerName: string, zoneId: string, hostname: string, opts?: ProvisionOptions): Promise<void>;
export {};
