/**
 * Translate a `start` command (e.g. "bun run server.ts") into an absolute
 * systemd ExecStart by swapping the leading runtime word for its absolute path.
 */
export declare function resolveExecStart(start: string, runtime: 'bun' | 'node' | 'deno'): string;
export interface BuildSiteDeployScriptOptions {
    siteName: string;
    slug: string;
    /** How the remote host obtains the release tarball */
    artifactFetch: string[];
    /** Site base dir holding `releases/`, `shared/`, `current`. Default `/var/www/<site>`. */
    appDir?: string;
    /** Unique id for this release dir (typically the commit sha). */
    releaseId: string;
    execStart: string;
    envEntries: Record<string, string>;
    port?: number;
    /** Past releases to keep for rollback. @default {@link DEFAULT_KEEP_RELEASES} */
    keepReleases?: number;
    /**
     * Commands run inside the new release dir after extraction + `.env` link,
     * before the `current` symlink is repointed and the service restarted.
     * Typically dependency install and/or build steps (e.g.
     * `bun install --frozen-lockfile`, `bun run build`) so the tarball can omit
     * `node_modules`.
     */
    preStartCommands?: string[];
    /**
     * Extra paths kept in `shared/` and symlinked into each release, so they
     * survive a deploy. `.env` is always shared; anything the app WRITES and must
     * keep (a state directory, a database file) has to be listed here or the next
     * release silently starts from empty.
     */
    sharedPaths?: readonly string[];
    /**
     * True zero-downtime cutover for ported sites: the new release runs as its
     * own systemd instance (`<slug>-<site>@<releaseId>`) that binds the same
     * port via SO_REUSEPORT while the old instance still serves, must pass a
     * health gate, and only then is the old instance stopped. A release that
     * crashes on boot fails the deploy with the old release still serving.
     *
     * Requires the app to bind with `reusePort` (Stacks' server does in
     * production). Defaults to true when `port` is set; portless sites
     * (queue workers, schedulers) always use the stop/start flow because two
     * overlapping instances would double-process their work.
     */
    zeroDowntime?: boolean;
    /**
     * HTTP path polled on `127.0.0.1:<port>` as part of the health gate (e.g.
     * `/health`). Optional — without it the gate is "the instance stays
     * active for {@link BuildSiteDeployScriptOptions.healthGateSeconds}".
     */
    healthCheckPath?: string;
    /**
     * Seconds the new instance must stay active (and, with
     * {@link BuildSiteDeployScriptOptions.healthCheckPath}, respond 2xx/3xx)
     * before the old instance is stopped.
     * @default 5
     */
    healthGateSeconds?: number;
}
/**
 * Build the remote shell commands that install/refresh a server-app site on a
 * compute target with an atomic release (Envoyer-style): unpack into
 * `releases/<id>`, link the shared `.env`, build, then cut over.
 *
 * The cutover has two modes:
 * - **zero-downtime** (default for ported sites): the new release starts as a
 *   templated systemd instance that shares the port via SO_REUSEPORT with the
 *   still-running old instance, must pass a health gate, and only then does
 *   the old instance stop — no dropped connections, and a crash-on-boot
 *   release fails the deploy with the old one still serving.
 * - **restart** (portless sites, or `zeroDowntime: false`): the classic flip
 *   `current` + `systemctl restart` — correct for workers/schedulers where two
 *   overlapping instances would double-process work.
 */
export declare function buildSiteDeployScript(options: BuildSiteDeployScriptOptions): string[];
export interface BuildStaticSiteDeployScriptOptions {
    siteName: string;
    /** Project slug — namespaces the staged tarball on shared boxes. */
    slug?: string;
    /** How the remote host obtains the release tarball */
    artifactFetch: string[];
    /** Site base dir holding `releases/`, `current`. Default `/var/www/<site>`. */
    appDir?: string;
    /** Unique id for this release dir (typically the commit sha). */
    releaseId: string;
    /** Past releases to keep for rollback. @default {@link DEFAULT_KEEP_RELEASES} */
    keepReleases?: number;
    /**
     * Commands run inside the new release dir after extraction — e.g. build the
     * docs/blog on the box itself (`bun install`, `bun run docs:build`) when the
     * tarball ships source rather than a pre-built site.
     */
    preStartCommands?: string[];
}
/**
 * Build the remote shell commands that install/refresh a STATIC site on a
 * compute target with a **zero-downtime atomic release** (Envoyer-style). Unlike
 * {@link buildSiteDeployScript}, there is no systemd service: the artifact is
 * unpacked into `releases/<id>` and `current` is repointed atomically, so the
 * docroot is never empty mid-deploy. The gateway serves `<base>/current` (rpx +
 * tlsx), which ts-cloud points at the symlink. Old releases are pruned.
 */
export declare function buildStaticSiteDeployScript(options: BuildStaticSiteDeployScriptOptions): string[];
/**
 * Box-local staging path for the uploaded release tarball. Namespaced by
 * project slug + site + release id so two projects sharing a box (or two
 * overlapping deploys of one site) never clobber each other's tarball between
 * the fetch and the extract — the flat `/tmp/<site>-release.tar.gz` layout
 * cross-contaminated releases on shared boxes.
 */
export declare function releaseTarballTmpPath(slug: string | undefined, siteName: string, releaseId: string): string;
export declare function buildAwsArtifactFetch(bucket: string, key: string, region: string, destPath: string): string[];
export declare function buildLocalArtifactFetch(localPath: string, destPath: string): string[];
/**
 * Bounded, multi-tenant-safe host maintenance run after a successful deploy.
 * Current and rollback releases are deliberately out of scope: their retention
 * is managed by buildPruneReleases. This only removes abandoned staging/temp
 * archives, aged package caches, unused container images, and old journals.
 */
export declare function buildHostCleanupScript(): string[];
