/**
 * Auto-deploy of the ts-cloud management dashboard on every server
 * provision/deploy, so every box ships with a cockpit.
 *
 * **Live (the default).** The dashboard runs as a service on the box
 * (`cloud dashboard:serve --box`) behind the proxy. It serves live data and the
 * control API, and authenticates itself: a login page, sessions, and per-site
 * collaborator grants. The release is tiny — the project's cloud config plus a
 * `package.json` — and the box installs `@stacksjs/ts-cloud` from npm, which
 * carries both the CLI and the UI it serves.
 *
 * On the first live deploy the box mints an admin and prints the password once
 * into the deploy log. Users and the session key live in the site's shared
 * `.ts-cloud/`, so they survive later deploys.
 *
 * **Static (`TS_CLOUD_UI_STATIC`).** The built UI shipped as files behind
 * htpasswd. One shared password, all data baked in at build time, and therefore
 * no collaborators. Kept for boxes that cannot run the service.
 *
 * Env:
 * - `TS_CLOUD_UI_STATIC`    set truthy for the old static + htpasswd model
 * - `TS_CLOUD_UI_DOMAIN`    explicit dashboard host (else `dashboard.<apex>`)
 * - `TS_CLOUD_UI_PORT`      loopback port for the live service (default 7676)
 * - `TS_CLOUD_UI_VERSION`   ts-cloud version the box installs (default: this one)
 * - `TS_CLOUD_UI_DISABLE`   set truthy to skip auto-deploy
 *
 * Static mode only:
 * - `TS_CLOUD_UI_PASSWORD`  htpasswd password (unset ⇒ auto-generated + saved)
 * - `TS_CLOUD_UI_PUBLIC`    set truthy to serve WITHOUT auth (opt-out, insecure)
 * - `TS_CLOUD_UI_USERNAME`  htpasswd user (default `admin`)
 * - `TS_CLOUD_UI_REALM`     browser auth realm
 */
import type { CloudConfig } from '@ts-cloud/core';
/**
 * Legacy site key for the management dashboard. Auto-injected dashboards are
 * now keyed per domain (`dashboard-<apex-dashed>`, see
 * `managementDashboardSiteName` in `@ts-cloud/core`) so tenants sharing a box
 * via `attachTo` never collide on `/var/www/dashboard`. This bare key remains
 * only for hand-configured dashboards and pre-0.8 deploys.
 */
export declare const MANAGEMENT_DASHBOARD_SITE = "dashboard";
/** Where an auto-generated dashboard password is persisted (per project checkout). */
export declare function dashboardCredentialsFile(): string;
export interface ResolvedDashboardAuth {
    /** The htpasswd password, or undefined when serving publicly (opt-out). */
    password?: string;
    /** How the password was resolved: explicit env, generated+saved, or public. */
    source: 'env' | 'generated' | 'public';
}
/**
 * Resolve the dashboard's Basic-auth password (secure by default):
 *  1. `TS_CLOUD_UI_PASSWORD` when set → use it verbatim.
 *  2. `TS_CLOUD_UI_PUBLIC` truthy → serve with NO auth (deliberate opt-out).
 *  3. Otherwise → reuse a previously-generated password from
 *     `dashboard-credentials.json` in the state directory, or generate and
 *     persist a new one.
 *
 * Persisting the generated password keeps htpasswd stable across deploys (so a
 * saved credential keeps working) and lets the operator retrieve it locally.
 */
export declare function resolveDashboardAuth(cwd: string, username: string, logger: EnsureDashboardLogger): ResolvedDashboardAuth;
export interface EnsureDashboardLogger {
    info: (msg: string) => void;
    warn: (msg: string) => void;
}
/** Where the live dashboard's release is staged, inside the project checkout. */
export declare function liveStageDir(): string;
/**
 * The ts-cloud version the box should install. Reads this package's own version
 * so a box runs a dashboard matching the CLI that deployed it, rather than
 * drifting to whatever `latest` happens to be mid-deploy.
 */
export declare function resolveDashboardVersion(): string;
/**
 * Stage the live dashboard's release: the RESOLVED cloud config inlined as a
 * self-contained module, plus a `package.json` whose install pulls the CLI and
 * UI from npm.
 *
 * The config is serialized rather than copied because a real one imports things
 * that do not exist on the box — Stacks' does `import { servers } from
 * '~/cloud/servers'` — and the import would throw, leaving the dashboard with
 * nothing to describe. Credentials are stripped on the way out.
 *
 * Returns the staged directory relative to `cwd`, or null when staging fails.
 */
export declare function stageLiveDashboardRoot(config: CloudConfig, cwd: string, logger: EnsureDashboardLogger): string | null;
/**
 * Resolve the UI source to ship (STATIC mode only — the live dashboard gets its
 * UI from the npm package it installs on the box). Prefers the repo's local
 * `packages/ui/` (built on the deploy machine), then the prebuilt UI bundled in
 * the installed package. Returns `{ uiRoot, build }` or null when unavailable.
 */
export declare function resolveUiSource(cwd: string): {
    uiRoot: string;
    build: string | false;
} | null;
/**
 * Inject the management dashboard into `config.sites` for a server deploy.
 * Mutates and returns `config`. Idempotent and safe to call on every deploy.
 */
export declare function ensureManagementDashboard(config: CloudConfig, options?: {
    cwd?: string;
    logger?: EnsureDashboardLogger;
}): CloudConfig;
/** Names of the management-dashboard sites currently present in `config`. */
export declare function managementDashboardSiteNames(config: CloudConfig): string[];
export interface BuildDashboardArtifactOptions {
    cwd?: string;
    slug: string;
    sha: string;
    /** Site key the tarball is staged under. @default MANAGEMENT_DASHBOARD_SITE */
    siteName?: string;
    logger?: EnsureDashboardLogger;
}
/**
 * Build the management-dashboard release tarball from its injected site config:
 * run the UI `build` (when not already built), then package `site.root`. Returns
 * the tarball path, or null when the UI cannot be built/found.
 *
 * Best-effort: the dashboard is auxiliary, so any failure logs and returns null
 * rather than throwing — the surrounding app deploy must never be blocked by it.
 */
export declare function buildManagementDashboardArtifact(site: {
    root?: string;
    build?: string | false;
} | undefined, options: BuildDashboardArtifactOptions): string | null;
