/**
 * kubectl-wrap.ts — subprocess timeout wrapper for kubectl invocations.
 *
 * Phase 1b C1 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
 * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
 *
 * ALL kubectl invocations in olam-cli MUST go through `kubectlWrap`.
 * Direct `child_process.spawn('kubectl', ...)` calls outside this module
 * break the timeout guarantee and fail `audit:kubectl-callers` (Seam C1).
 *
 * Timeout lifecycle:
 *   1. Spawn kubectl with the provided args.
 *   2. Start wall-clock timer (default 120 000 ms; per-call configurable).
 *   3. On timer fire: SIGTERM the process; wait 5 000 ms; SIGKILL if still alive.
 *   4. Returns { ok: false, reason: 'timeout', … } immediately after the kill
 *      sequence completes (does not wait further for exit after SIGKILL).
 *
 * Returns:
 *   { ok: true,  stdout, stderr, exitCode }       — clean exit 0
 *   { ok: false, stdout, stderr, exitCode, reason } — non-zero exit or timeout
 *
 * reason values:
 *   'timeout'  — wall-clock limit exceeded; process SIGKILLed
 *   'spawn'    — spawn itself failed (e.g. kubectl not on PATH)
 *   'nonzero'  — kubectl exited with non-zero status
 */
import { spawn } from 'node:child_process';
export declare const DEFAULT_TIMEOUT_MS = 120000;
export type KubectlResult = {
    ok: true;
    stdout: string;
    stderr: string;
    exitCode: number;
} | {
    ok: false;
    stdout: string;
    stderr: string;
    exitCode: number;
    reason: 'timeout' | 'spawn' | 'nonzero';
};
export interface KubectlWrapOpts {
    /** Per-call timeout override (ms). Defaults to DEFAULT_TIMEOUT_MS (120 s). */
    readonly timeout?: number;
    /** Additional environment variables to merge into the subprocess env. */
    readonly env?: Record<string, string>;
    /**
     * spawn factory — injectable for tests so unit tests never fork a real kubectl.
     * Signature matches `child_process.spawn` return type.
     */
    readonly spawnImpl?: typeof spawn;
    /**
     * Optional stdin payload. When set, the subprocess stdin is set to 'pipe'
     * and this string is written then closed. Used for `kubectl apply -f -`
     * patterns (C1 ConfigMap substitution; D20 — value never in argv).
     */
    readonly stdin?: string;
}
/**
 * Invoke kubectl with a timeout.
 *
 * @param args - kubectl arguments (e.g. ['get', 'pods', '-n', 'olam'])
 * @param opts - timeout, env overrides, and spawn factory for injection
 */
export declare function kubectlWrap(args: readonly string[], opts?: KubectlWrapOpts): Promise<KubectlResult>;
//# sourceMappingURL=kubectl-wrap.d.ts.map