/**
 * Provision on-box managed services (Forge single-server model) via **pantry**:
 * the database engine, cache, and search are installed from the pantry registry
 * and run as boot-time systemd services, plus the application database + user
 * are created. When the app points at a managed/external database instead,
 * install nothing and just wire `.env` — see {@link buildManagedDbEnv}.
 *
 * pantry services listen on TCP localhost ports (mysql/mariadb 3306, postgres
 * 5432, redis 6379, memcached 11211, meilisearch 7700) and the engine clients
 * are on PATH via `pantry env`. Admin commands (db setup, dumps, restores)
 * connect over the engine's local unix socket — see {@link pgAdminCommand}.
 */
import type { ComputeServicesConfig, DatabaseConfig } from '@ts-cloud/core';
/**
 * True when the database is co-located with the box (the managed-services
 * engine): no host configured, or an explicit loopback host. Anything else is
 * an external/managed database reached over TCP.
 */
export declare function isLocalDatabase(database: DatabaseConfig | undefined): boolean;
/**
 * Build the connection prefix for a postgres admin command (`psql`/`pg_dump`)
 * run on the box.
 *
 * The pantry postgres pg_hba grants `trust` on the local unix socket but
 * requires md5 password auth over TCP loopback — and the `postgres` superuser
 * has no password — so against the co-located engine admin clients MUST use
 * the socket: omit `-h` entirely and the pantry client uses its compiled-in
 * default socket dir, which matches the server's by construction (verified
 * on-box: `psql -U postgres` from root connects passwordless). Against an
 * external/managed host, use TCP with the configured credentials
 * (`PGPASSWORD` inline + `-w`, so a missing password fails fast instead of
 * prompting forever).
 */
export declare function pgAdminCommand(database: DatabaseConfig | undefined, tool?: 'psql' | 'pg_dump'): string;
/**
 * Build pantry install + enable/start commands for each requested on-box
 * service. Idempotent (pantry install/enable/start are no-ops when satisfied).
 * `options.bindPrivate` is accepted for fleet compatibility; pantry's services
 * already bind all interfaces behind the firewall.
 */
export declare function buildServicesProvisionScript(services?: ComputeServicesConfig, _options?: {
    bindPrivate?: boolean;
}): string[];
/**
 * Build the commands that create the application database + user on the on-box
 * engine. Idempotent (uses IF NOT EXISTS / existence guards). Returns `[]` when
 * the database points at a managed host or lacks a name. The engine client is
 * put on PATH via `pantry env` and connects over TCP localhost.
 */
export declare function buildDatabaseSetupScript(database: DatabaseConfig | undefined, services?: ComputeServicesConfig): string[];
/**
 * `.env` key/value pairs wiring a Laravel app at the (on-box or managed)
 * database. Merge into a site's `env` so `DB_*` is set without hand-copying
 * credentials. Returns `{}` when there's nothing to wire.
 */
export declare function buildManagedDbEnv(database: DatabaseConfig | undefined): Record<string, string>;
