/**
 * kubectl-context.ts — shared kubectl-context resolver.
 *
 * Single source of truth for the D1 / SEC-NEW-003 context-resolution
 * policy. Extracted so `upgrade-kubernetes.ts`, `auth-refresh-kubernetes.ts`,
 * `services.ts`, and any future kubernetes-substrate consumer can call the
 * same helper instead of duplicating it.
 *
 * Policy (matches the pre-existing auth-refresh-kubernetes.ts and services.ts
 * behaviour — see also docs/architecture/peripheral-services-on-k3s.md):
 *
 *   1. `host.kubectl_context_pinned` in `~/.olam/config.json` (preferred,
 *      persistent — the doc-recommended way).
 *   2. `OLAM_K8S_CONTEXT_ACK` env var (deprecated fallback; emits a
 *      deprecation warning to nudge operators toward (1)).
 *   3. Both absent → error result with actionable remediation.
 *
 * No `fs` reads in this module beyond what `readConfig` does; no kubectl
 * invocations. Pure resolution. Safe to call from any layer.
 */
import { writeConfig } from './config.js';
/**
 * Result shape mirrors `auth-refresh-kubernetes.ts`'s pre-existing public
 * `resolveKubectlContext` so callers there can be migrated without source
 * changes. Exactly one of `context` or `error` is set.
 */
export interface KubectlContextResolution {
    readonly context?: string;
    readonly deprecationWarning?: string;
    readonly error?: string;
}
/**
 * Canonical kubectl context provisioned by `olam setup` / `olam up` — the
 * k3d cluster named by `DEFAULT_K3S_CLUSTER` (`olam-host`) surfaces as the
 * context `k3d-olam-host`. Defined locally (rather than imported from
 * bootstrap-kubernetes.ts) to avoid a module cycle; kept in sync via this
 * comment. When present among the operator's contexts, auto-pin prefers it.
 */
export declare const CANONICAL_K3S_CONTEXT = "k3d-olam-host";
/**
 * Resolve the operator's kubectl context name. See module docstring for policy.
 *
 * `configPath` lets callers (and tests) point at a non-default config file.
 * Returns a `KubectlContextResolution` — callers branch on `error` vs `context`.
 */
export declare function resolveKubectlContext(configPath?: string): KubectlContextResolution;
/**
 * Injection seam for `autoPinKubectlContext`. Production callers use the
 * defaults (shell out to `kubectl`, write `~/.olam/config.json`); tests inject
 * pure functions.
 */
export interface AutoPinDeps {
    /** Enumerate kubeconfig context names. Default: `kubectl config get-contexts -o name`. */
    readonly getContexts?: () => string[];
    /** Persist the chosen pin. Default: `writeConfig` (lib/config.ts). */
    readonly writeConfigFn?: typeof writeConfig;
    /** Override config path (tests). Default: `~/.olam/config.json`. */
    readonly configPath?: string;
}
/**
 * Result of an auto-pin attempt. Exactly one of `context` (resolved — either
 * pre-existing or freshly auto-pinned) or `error` (could not resolve
 * unambiguously) is set. `autoPinnedMessage` is present only when this call
 * wrote a new pin, so the caller can surface what it did.
 */
export interface AutoPinResult {
    readonly context?: string;
    readonly autoPinnedMessage?: string;
    readonly error?: string;
}
/**
 * Resolve the kubectl context, auto-pinning when it can be done unambiguously.
 *
 * Unlike the pure `resolveKubectlContext`, this helper is allowed to (a) shell
 * out to `kubectl` to enumerate contexts and (b) persist a pin to
 * `~/.olam/config.json`. It exists so the onboarding flow (`olam upgrade`)
 * helps the operator resolve a missing pin instead of dead-ending.
 *
 * Policy:
 *   - Already pinned / `OLAM_K8S_CONTEXT_ACK` set → return it, write nothing.
 *   - Exactly the canonical `k3d-olam-host` present → pin it.
 *   - Exactly one `k3d-olam-*` context present → pin it.
 *   - Zero or multiple non-canonical `k3d-olam-*` → return an actionable error
 *     listing the candidates and the exact `olam config set` command.
 */
export declare function autoPinKubectlContext(deps?: AutoPinDeps): AutoPinResult;
//# sourceMappingURL=kubectl-context.d.ts.map