import type { Kysely } from "kysely";
import type { VetraCloudEnvironmentService, VetraCloudEnvironmentState } from "../../document-models/vetra-cloud-environment/index.js";
import type { DB } from "./schema.js";
import type { SecretsService } from "../../subgraphs/vetra-cloud-secrets/services/secrets-service.js";
interface GitOpsConfig {
    /** URL of the remote gitops repo (used for ephemeral clones). */
    repoUrl: string;
    remote: string;
    branch: string;
}
export declare function toKebabCase(name: string): string;
/**
 * Build a unique infrastructure tenant ID.
 *
 * Format: `<subdomain>-<shortDocId>`
 *
 * The subdomain alone can collide (250k namespace), so we append the first 8
 * hex chars of the documentId to guarantee uniqueness.
 */
export declare function getTenantId(subdomain: string, documentId: string): string;
/**
 * A service's generic `.vetra.io` ingress host, as a SINGLE DNS label so it is
 * covered by the cluster `*.vetra.io` wildcard cert (served via Traefik's
 * TLSStore/default — see infrastructure/wildcard-tls):
 *   apex  -> `<subdomain>.<baseDomain>`              (e.g. tall-duck-ab12.vetra.io)
 *   other -> `<subdomain>-<prefix>.<baseDomain>`     (e.g. tall-duck-ab12-connect.vetra.io)
 */
export declare function resolveGenericHost(subdomain: string, prefix: string, isApex: boolean, baseDomain: string): string;
/**
 * The service TYPE served at the env apex (`<subdomain>.vetra.io`). Explicit
 * `apexService` wins; otherwise a lone enabled service auto-claims the apex (so a
 * single-CLINT Studio gets the bare subdomain). Null when ambiguous (multiple
 * enabled services, none pinned).
 */
export declare function effectiveApexType(state: VetraCloudEnvironmentState): VetraCloudEnvironmentService["type"] | null;
/**
 * Whether a given service type is served at the apex. The bare apex host can
 * belong to only ONE service, so the type must have exactly one enabled instance
 * (guards multi-agent CLINT envs from colliding on the bare host).
 */
export declare function isTypeAtApex(state: VetraCloudEnvironmentState, type: VetraCloudEnvironmentService["type"]): boolean;
/** Guard: a single DNS label must be ≤63 chars (RFC 1035). */
export declare function assertHostLabelLength(host: string): void;
export declare function generateValuesYaml(db: Kysely<DB>, state: VetraCloudEnvironmentState, documentId: string, secretsService?: SecretsService | null): Promise<string>;
/**
 * Sync an environment's values to the gitops repo.
 *
 * Reuses a single persistent working clone, refreshed to a pristine
 * origin/branch (fetch + reset --hard + clean) before each render, then writes
 * the values file, commits, and pushes. Reusing the clone — instead of a fresh
 * clone per sync — is what keeps a claim's gitops re-render off the multi-second
 * critical path.
 *
 * A mutex serializes syncs within the same process so the shared working tree
 * is never touched concurrently. Cross-process / cross-pod push races are
 * handled by pull-rebase-retry.
 */
export declare function syncEnvironment(db: Kysely<DB>, state: VetraCloudEnvironmentState, documentId: string, secretsService?: SecretsService | null): Promise<void>;
/**
 * Remove a tenant's directory from the gitops repo.
 *
 * Called when an environment document is deleted. Removes the tenant
 * directory, commits, and pushes so ArgoCD/Flux tears down the deployment.
 */
export declare function deleteEnvironmentFromGitops(tenantId: string): Promise<void>;
export declare function withWorkingClone(fn: (cloneDir: string, config: GitOpsConfig) => Promise<void>): Promise<void>;
export {};
//# sourceMappingURL=gitops.d.ts.map