import type { CloudConfig, CloudDriver, EnvironmentType } from '@ts-cloud/core';
import type { CloudWatchLogsClient } from '../aws/cloudwatch-logs';
import type { ECSClient } from '../aws/ecs';
import type { LifecycleAction, RuntimeInventory, RuntimeWorkload } from './model';
export interface RuntimeOperationInput {
    workloadId: string;
    action: LifecycleAction;
    confirm?: string;
    replicas?: number;
    recentAuth?: boolean;
}
export interface RuntimeOperationResult {
    ok: boolean;
    workloadId: string;
    action: LifecycleAction;
    command?: string;
    stdout?: string;
    stderr?: string;
    error?: string;
    workload?: RuntimeWorkload;
}
export interface RuntimeLogResult {
    workloadId: string;
    provider: RuntimeWorkload['provider'];
    lines: Array<{
        timestamp?: string;
        message: string;
    }>;
    nextCursor?: string;
    truncated: boolean;
}
export interface RuntimeExecInput {
    workloadId: string;
    preset?: keyof typeof DIAGNOSTIC_PRESETS;
    command?: string;
    confirm?: string;
    recentAuth?: boolean;
}
export interface RuntimeExecResult {
    ok: boolean;
    workloadId: string;
    preset?: keyof typeof DIAGNOSTIC_PRESETS;
    command?: string;
    stdout?: string;
    stderr?: string;
    error?: string;
}
export interface RuntimeFileInput {
    workloadId: string;
    path: string;
    confirm?: string;
    recentAuth?: boolean;
}
export interface RuntimeFileReadResult {
    ok: boolean;
    workloadId: string;
    path: string;
    contentBase64?: string;
    size?: number;
    truncated?: boolean;
    error?: string;
}
export interface RuntimeFileWriteInput extends RuntimeFileInput {
    contentBase64: string;
}
interface EcsMutator extends Pick<ECSClient, 'scaleService' | 'forceNewDeployment'> {
}
interface LogReader extends Pick<CloudWatchLogsClient, 'filterLogEvents'> {
}
export interface RuntimeOperationDependencies {
    driver?: CloudDriver;
    ecs?: EcsMutator;
    logs?: LogReader;
    inventory?: () => Promise<RuntimeInventory>;
}
/**
 * Permit file operations only below a service-owned root or a discovered bind/
 * volume target. Host-sensitive trees stay forbidden even if a mount points at
 * one. This function never follows the requested path on the dashboard host.
 */
export declare function authorizeRuntimePath(_workload: RuntimeWorkload, _requested: string): {
    ok: true;
    path: string;
} | {
    ok: false;
    error: string;
};
export declare const DIAGNOSTIC_PRESETS: {
    readonly process: readonly ['ps', '-eo', 'pid,ppid,user,%cpu,%mem,etime,command', '--sort=-%cpu'];
    readonly sockets: readonly ['ss', '-lntup'];
    readonly filesystem: readonly ['df', '-h'];
};
export declare class RuntimeOperationService {
    private readonly config;
    private readonly environment;
    private readonly dependencies;
    private readonly region;
    private readonly profile?;
    constructor(config: CloudConfig, environment: EnvironmentType, dependencies?: RuntimeOperationDependencies);
    inventory(): Promise<RuntimeInventory>;
    workload(id: string): Promise<RuntimeWorkload | undefined>;
    private remote;
    run(input: RuntimeOperationInput): Promise<RuntimeOperationResult>;
    exec(input: RuntimeExecInput): Promise<RuntimeExecResult>;
    readFile(input: RuntimeFileInput): Promise<RuntimeFileReadResult>;
    writeFile(input: RuntimeFileWriteInput): Promise<RuntimeFileReadResult>;
    private fileTarget;
    logs(workloadId: string, input?: {
        limit?: number;
        since?: Date;
    }): Promise<RuntimeLogResult>;
}
export {};
