/**
 * The single place Hetzner settings are resolved.
 *
 * Every Hetzner value can come from several sources, and they used to be
 * resolved ad-hoc wherever they were needed: the driver, the API client and the
 * dashboard each had their own chain, with defaults duplicated at call sites.
 * That drifted — the dashboard honored `HETZNER_LOCATION` while the driver did
 * not, so a box provisioned in `fsn1` was reported as being somewhere else.
 *
 * One precedence, applied everywhere:
 *
 *   1. an explicit argument (a driver option — the caller means it)
 *   2. `cloud.config.ts` → `hetzner.*` (checked into the repo, reviewable)
 *   3. environment (`HCLOUD_*`, with the `HETZNER_*` alias) — for secrets and
 *      per-machine overrides
 *   4. the documented default in {@link HETZNER_DEFAULTS}
 *
 * Config beats environment deliberately, for every field without exception: a
 * value written in `cloud.config.ts` is the reviewed intent for the project,
 * and a stray shell export should not silently redirect a deploy to another
 * datacenter or another account. One rule, no special cases to remember.
 *
 * In practice the token is simply left out of `cloud.config.ts` (it is a
 * secret), so it comes from `HCLOUD_TOKEN` — but that is a convention, not a
 * different precedence.
 */
import type { CloudConfig } from '@ts-cloud/core';
/** The documented defaults. These are the only place a Hetzner default lives. */
export declare const HETZNER_DEFAULTS: {
    /** Falkenstein, Germany. */
    readonly location: 'fsn1';
    readonly image: 'ubuntu-24.04';
    readonly sshUser: 'root';
    readonly sshPrivateKeyPath: '~/.ssh/id_ed25519';
};
/** `~/…` → an absolute path. Hetzner key paths are user-supplied and often use `~`. */
export declare function expandHome(path: string): string;
/**
 * The Hetzner API token, or undefined when none is set.
 *
 * Never defaulted: a missing token must fail loudly at the call site rather
 * than silently targeting the wrong account. Callers that need one should use
 * `requireHetznerApiToken`.
 */
export declare function resolveHetznerApiToken(explicit?: string, config?: CloudConfig): string | undefined;
/** Datacenter location slug, e.g. `fsn1`, `nbg1`, `hel1`. */
export declare function resolveHetznerLocation(config?: CloudConfig, explicit?: string): string;
/**
 * Server image slug.
 *
 * `infrastructure.compute.image` wins over `hetzner.image`: it is the
 * provider-agnostic way to pin an image (and is what a golden-image bake sets),
 * so it is the more specific statement of intent.
 */
export declare function resolveHetznerImage(config?: CloudConfig, explicit?: string): string;
/** SSH user for deploy commands. */
export declare function resolveHetznerSshUser(config?: CloudConfig, explicit?: string): string;
/** Absolute path to the SSH private key used for deploy commands. */
export declare function resolveHetznerSshPrivateKeyPath(config?: CloudConfig, explicit?: string): string;
/**
 * Absolute path to the SSH public key uploaded to Hetzner. Defaults to the
 * private key's path with `.pub`, which is where `ssh-keygen` puts it.
 */
export declare function resolveHetznerSshPublicKeyPath(config?: CloudConfig, explicit?: string, privateKeyPath?: string): string;
/** Every resolved Hetzner setting, for a driver or a diagnostic to read at once. */
export interface ResolvedHetznerSettings {
    apiToken?: string;
    location: string;
    image: string;
    sshUser: string;
    sshPrivateKeyPath: string;
    sshPublicKeyPath: string;
}
export interface HetznerOverrides {
    apiToken?: string;
    location?: string;
    image?: string;
    sshUser?: string;
    sshPrivateKeyPath?: string;
    sshPublicKeyPath?: string;
}
/** Resolve the full Hetzner settings for `config`, applying `overrides` first. */
export declare function resolveHetznerSettings(config?: CloudConfig, overrides?: HetznerOverrides): ResolvedHetznerSettings;
