@treeseed/sdk 0.12.62 → 0.13.0-rc.10

package/dist/operations/services/key-agent.js

@@ -1,641 +0,0 @@
-import { createCipheriv, createDecipheriv, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
-import { accessSync, chmodSync, constants as fsConstants, existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, resolve } from "node:path";
-import { createConnection, createServer } from "node:net";
-const TRESEED_MACHINE_KEY_PASSPHRASE_ENV = "TREESEED_KEY_PASSPHRASE";
-const TRESEED_KEY_AGENT_IDLE_TIMEOUT_MS = 15 * 60 * 1e3;
-const TREESEED_KEY_AGENT_IDLE_TIMEOUT_MS = TRESEED_KEY_AGENT_IDLE_TIMEOUT_MS;
-const TRESEED_WRAPPED_MACHINE_KEY_VERSION = 2;
-const TRESEED_WRAPPED_MACHINE_KEY_KIND = "treeseed-wrapped-machine-key";
-const TREESEED_MACHINE_KEY_PASSPHRASE_ENV = TRESEED_MACHINE_KEY_PASSPHRASE_ENV;
-const KEY_AGENT_SOCKET_RELATIVE_PATH = ".treeseed/run/key-agent.sock";
-const KEY_AGENT_REQUEST_TIMEOUT_MS = 3e3;
-const WRAPPED_KEY_KDF_PARAMS = {
-  N: 1 << 14,
-  r: 8,
-  p: 1,
-  keyLength: 32
-};
-class TreeseedKeyAgentError extends Error {
-  code;
-  details;
-  constructor(code, message, details) {
-    super(message);
-    this.name = "TreeseedKeyAgentError";
-    this.code = code;
-    this.details = details;
-  }
-}
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
-function ensureDirectory(path, mode = 448) {
-  mkdirSync(path, { recursive: true, mode });
-  chmodSync(path, mode);
-}
-function ensureParent(filePath) {
-  ensureDirectory(dirname(filePath), 448);
-}
-function pidFilePath(socketPath) {
-  return `${socketPath}.pid`;
-}
-function detectSocketKind(socketPath) {
-  if (!existsSync(socketPath)) {
-    return "missing";
-  }
-  try {
-    const stats = lstatSync(socketPath);
-    if (stats.isSocket()) {
-      return "socket";
-    }
-    if (stats.isFIFO()) {
-      return "fifo";
-    }
-    if (stats.isFile()) {
-      return "file";
-    }
-    if (stats.isDirectory()) {
-      return "directory";
-    }
-    return "other";
-  } catch {
-    return "other";
-  }
-}
-function createFingerprint(machineKey) {
-  return machineKey.subarray(0, 6).toString("base64");
-}
-function deriveWrappingKey(passphrase, salt, keyLength) {
-  return scryptSync(passphrase.normalize("NFKC"), salt, keyLength, {
-    N: WRAPPED_KEY_KDF_PARAMS.N,
-    r: WRAPPED_KEY_KDF_PARAMS.r,
-    p: WRAPPED_KEY_KDF_PARAMS.p
-  });
-}
-function wrapMachineKey(machineKey, passphrase) {
-  const salt = randomBytes(16);
-  const iv = randomBytes(12);
-  const wrappingKey = deriveWrappingKey(passphrase, salt, WRAPPED_KEY_KDF_PARAMS.keyLength);
-  const cipher = createCipheriv("aes-256-gcm", wrappingKey, iv);
-  const ciphertext = Buffer.concat([cipher.update(machineKey), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return {
-    version: TRESEED_WRAPPED_MACHINE_KEY_VERSION,
-    kind: TRESEED_WRAPPED_MACHINE_KEY_KIND,
-    createdAt: nowIso(),
-    updatedAt: nowIso(),
-    kdf: {
-      algorithm: "scrypt",
-      salt: salt.toString("base64"),
-      N: WRAPPED_KEY_KDF_PARAMS.N,
-      r: WRAPPED_KEY_KDF_PARAMS.r,
-      p: WRAPPED_KEY_KDF_PARAMS.p,
-      keyLength: WRAPPED_KEY_KDF_PARAMS.keyLength
-    },
-    wrappedKey: {
-      algorithm: "aes-256-gcm",
-      iv: iv.toString("base64"),
-      tag: tag.toString("base64"),
-      ciphertext: ciphertext.toString("base64")
-    },
-    fingerprint: createFingerprint(machineKey)
-  };
-}
-function unwrapMachineKey(payload, passphrase) {
-  try {
-    const salt = Buffer.from(payload.kdf.salt, "base64");
-    const wrappingKey = deriveWrappingKey(passphrase, salt, payload.kdf.keyLength);
-    const decipher = createDecipheriv("aes-256-gcm", wrappingKey, Buffer.from(payload.wrappedKey.iv, "base64"));
-    decipher.setAuthTag(Buffer.from(payload.wrappedKey.tag, "base64"));
-    return Buffer.concat([
-      decipher.update(Buffer.from(payload.wrappedKey.ciphertext, "base64")),
-      decipher.final()
-    ]);
-  } catch (error) {
-    throw new TreeseedKeyAgentError(
-      "unlock_failed",
-      "Unable to unlock the Treeseed machine key. The passphrase is incorrect or the wrapped key file is corrupt.",
-      { cause: error instanceof Error ? error.message : String(error) }
-    );
-  }
-}
-function isWrappedMachineKeyPayload(value) {
-  if (!value || typeof value !== "object") {
-    return false;
-  }
-  const record = value;
-  return record.kind === TRESEED_WRAPPED_MACHINE_KEY_KIND && record.version === TRESEED_WRAPPED_MACHINE_KEY_VERSION;
-}
-function readWrappedMachineKeyFile(keyPath) {
-  if (!existsSync(keyPath)) {
-    return {
-      exists: false,
-      wrapped: null,
-      plaintextLegacy: null,
-      migrationRequired: false
-    };
-  }
-  const raw = readFileSync(keyPath, "utf8").trim();
-  if (!raw) {
-    return {
-      exists: false,
-      wrapped: null,
-      plaintextLegacy: null,
-      migrationRequired: false
-    };
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (isWrappedMachineKeyPayload(parsed)) {
-      return {
-        exists: true,
-        wrapped: parsed,
-        plaintextLegacy: null,
-        migrationRequired: false
-      };
-    }
-  } catch {
-  }
-  try {
-    return {
-      exists: true,
-      wrapped: null,
-      plaintextLegacy: Buffer.from(raw, "base64"),
-      migrationRequired: true
-    };
-  } catch {
-    throw new TreeseedKeyAgentError(
-      "corrupt_wrapped_key",
-      "Unable to parse the Treeseed machine key file.",
-      { keyPath }
-    );
-  }
-}
-function writeWrappedMachineKeyFile(keyPath, payload) {
-  ensureParent(keyPath);
-  writeFileSync(keyPath, `${JSON.stringify(payload, null, 2)}
-`, { mode: 384 });
-}
-function replaceWrappedMachineKey(keyPath, machineKey, passphrase) {
-  const payload = wrapMachineKey(machineKey, passphrase);
-  writeWrappedMachineKeyFile(keyPath, payload);
-  return payload;
-}
-function resolveRuntimeRoot() {
-  const xdgRuntimeDir = process.env.XDG_RUNTIME_DIR;
-  if (typeof xdgRuntimeDir === "string" && xdgRuntimeDir.trim().length > 0) {
-    try {
-      accessSync(xdgRuntimeDir, fsConstants.R_OK | fsConstants.W_OK | fsConstants.X_OK);
-      return resolve(xdgRuntimeDir, "treeseed");
-    } catch {
-    }
-  }
-  const homeRoot = process.env.HOME && process.env.HOME.trim().length > 0 ? process.env.HOME : homedir();
-  return resolve(homeRoot, dirname(KEY_AGENT_SOCKET_RELATIVE_PATH));
-}
-function getTreeseedKeyAgentPaths() {
-  const homeRoot = process.env.HOME && process.env.HOME.trim().length > 0 ? process.env.HOME : homedir();
-  const runtimeRoot = resolveRuntimeRoot();
-  const socketPath = runtimeRoot === resolve(homeRoot, dirname(KEY_AGENT_SOCKET_RELATIVE_PATH)) ? resolve(homeRoot, KEY_AGENT_SOCKET_RELATIVE_PATH) : resolve(runtimeRoot, "key-agent.sock");
-  return {
-    homeRoot,
-    runtimeRoot,
-    socketPath,
-    pidPath: pidFilePath(socketPath)
-  };
-}
-function readAgentPid(socketPath) {
-  const pidPath = pidFilePath(socketPath);
-  if (!existsSync(pidPath)) {
-    return null;
-  }
-  const raw = readFileSync(pidPath, "utf8").trim();
-  const pid = Number.parseInt(raw, 10);
-  return Number.isFinite(pid) ? pid : null;
-}
-function writePidFile(socketPath) {
-  ensureParent(socketPath);
-  writeFileSync(pidFilePath(socketPath), `${process.pid}
-`, { mode: 384 });
-}
-function clearPidFile(socketPath) {
-  rmSync(pidFilePath(socketPath), { force: true });
-}
-function classifySocketError(error) {
-  const errno = "code" in error ? error.code : void 0;
-  if (errno === "ENOENT") {
-    return {
-      code: "daemon_unavailable",
-      message: "Treeseed key-agent socket is missing."
-    };
-  }
-  if (errno === "EACCES" || errno === "EPERM") {
-    return {
-      code: "permission_denied",
-      message: "Permission denied while connecting to the Treeseed key-agent socket."
-    };
-  }
-  if (errno === "ECONNREFUSED" || errno === "ECONNRESET") {
-    return {
-      code: "daemon_unavailable",
-      message: "Treeseed key-agent daemon is not accepting connections."
-    };
-  }
-  return {
-    code: "protocol_error",
-    message: error.message || "Treeseed key-agent request failed."
-  };
-}
-async function requestTreeseedKeyAgentOverSocket(command, timeoutMs = KEY_AGENT_REQUEST_TIMEOUT_MS) {
-  return new Promise((resolvePromise, rejectPromise) => {
-    const socket = createConnection(command.socketPath);
-    let responseBuffer = "";
-    let settled = false;
-    const finalize = (callback) => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      clearTimeout(timeoutHandle);
-      socket.removeAllListeners();
-      callback();
-    };
-    const timeoutHandle = setTimeout(() => {
-      socket.destroy();
-      rejectPromise(new TreeseedKeyAgentError("daemon_unavailable", "Timed out waiting for the Treeseed key-agent response.", {
-        socketPath: command.socketPath
-      }));
-    }, timeoutMs);
-    socket.setEncoding("utf8");
-    socket.on("connect", () => {
-      socket.write(`${JSON.stringify(command)}
-`);
-    });
-    socket.on("data", (chunk) => {
-      responseBuffer += chunk;
-      const newlineIndex = responseBuffer.indexOf("\n");
-      if (newlineIndex === -1) {
-        return;
-      }
-      const payload = responseBuffer.slice(0, newlineIndex).trim();
-      socket.end();
-      try {
-        const parsed = JSON.parse(payload || "{}");
-        finalize(() => resolvePromise(parsed));
-      } catch (error) {
-        finalize(() => rejectPromise(new TreeseedKeyAgentError("protocol_error", "Treeseed key-agent returned an invalid JSON response.", {
-          socketPath: command.socketPath,
-          cause: error instanceof Error ? error.message : String(error)
-        })));
-      }
-    });
-    socket.on("error", (error) => {
-      const classified = classifySocketError(error);
-      finalize(() => rejectPromise(new TreeseedKeyAgentError(classified.code, classified.message, {
-        socketPath: command.socketPath,
-        cause: error.message
-      })));
-    });
-    socket.on("end", () => {
-      if (!settled && responseBuffer.trim().length === 0) {
-        finalize(() => rejectPromise(new TreeseedKeyAgentError("protocol_error", "Treeseed key-agent closed the connection without returning a response.", {
-          socketPath: command.socketPath
-        })));
-      }
-    });
-  });
-}
-async function inspectTreeseedKeyAgentDiagnostics(socketPath) {
-  const socketKind = detectSocketKind(socketPath);
-  const diagnostics = {
-    socketPath,
-    pidPath: pidFilePath(socketPath),
-    socketPresent: socketKind !== "missing",
-    socketKind,
-    socketConnectable: false,
-    healthOk: false,
-    daemonPid: readAgentPid(socketPath),
-    lastError: null
-  };
-  if (!diagnostics.socketPresent) {
-    diagnostics.lastError = "socket_missing";
-    return diagnostics;
-  }
-  if (diagnostics.socketKind !== "socket") {
-    diagnostics.lastError = `stale_transport_${diagnostics.socketKind}`;
-    return diagnostics;
-  }
-  try {
-    const response = await requestTreeseedKeyAgentOverSocket({
-      command: "health",
-      keyPath: "",
-      socketPath,
-      idleTimeoutMs: TREESEED_KEY_AGENT_IDLE_TIMEOUT_MS
-    });
-    diagnostics.socketConnectable = true;
-    diagnostics.healthOk = response.ok;
-    if (!response.ok) {
-      diagnostics.lastError = response.message ?? response.code ?? "health_failed";
-    }
-    return diagnostics;
-  } catch (error) {
-    const classified = classifySocketError(error instanceof Error ? error : new Error(String(error)));
-    diagnostics.lastError = classified.message;
-    return diagnostics;
-  }
-}
-function createStatus(command, session) {
-  const wrapped = command.keyPath ? readWrappedMachineKeyFile(command.keyPath) : { exists: false, wrapped: null, migrationRequired: false };
-  const idleRemainingMs = session.machineKey ? Math.max(0, session.idleTimeoutMs - (Date.now() - session.lastTouchedAt)) : 0;
-  return {
-    running: true,
-    unlocked: Boolean(session.machineKey) && idleRemainingMs > 0,
-    wrappedKeyPresent: wrapped.exists && Boolean(wrapped.wrapped),
-    migrationRequired: Boolean(wrapped.migrationRequired),
-    keyPath: command.keyPath,
-    socketPath: command.socketPath,
-    idleTimeoutMs: session.idleTimeoutMs,
-    idleRemainingMs
-  };
-}
-function maybeExpireSession(session) {
-  if (!session.machineKey) {
-    return;
-  }
-  if (Date.now() - session.lastTouchedAt >= session.idleTimeoutMs) {
-    session.machineKey = null;
-  }
-}
-function readLegacyProjectMachineKey(legacyKeyPath) {
-  if (!existsSync(legacyKeyPath)) {
-    return null;
-  }
-  try {
-    return Buffer.from(readFileSync(legacyKeyPath, "utf8").trim(), "base64");
-  } catch {
-    return null;
-  }
-}
-function unwrapOrProvisionMachineKey(command) {
-  const wrapped = readWrappedMachineKeyFile(command.keyPath);
-  if (wrapped.wrapped) {
-    return unwrapMachineKey(wrapped.wrapped, command.passphrase);
-  }
-  if (wrapped.plaintextLegacy) {
-    if (!command.allowMigration) {
-      throw new TreeseedKeyAgentError(
-        "wrapped_key_migration_required",
-        "The Treeseed machine key is still stored in the legacy plaintext format. Run a migration or unlock interactively to wrap it first.",
-        { keyPath: command.keyPath }
-      );
-    }
-    replaceWrappedMachineKey(command.keyPath, wrapped.plaintextLegacy, command.passphrase);
-    return wrapped.plaintextLegacy;
-  }
-  if (!command.createIfMissing) {
-    throw new TreeseedKeyAgentError(
-      "wrapped_key_missing",
-      "No wrapped Treeseed machine key exists yet. Create one by unlocking interactively or with a startup passphrase.",
-      { keyPath: command.keyPath }
-    );
-  }
-  const machineKey = randomBytes(32);
-  replaceWrappedMachineKey(command.keyPath, machineKey, command.passphrase);
-  return machineKey;
-}
-function ok(response = {}) {
-  return { ok: true, ...response };
-}
-function fail(error, command) {
-  const wrappedState = command.keyPath ? readWrappedMachineKeyFile(command.keyPath) : { wrapped: null, migrationRequired: false };
-  if (error instanceof TreeseedKeyAgentError) {
-    return {
-      ok: false,
-      code: error.code,
-      message: error.message,
-      status: {
-        running: true,
-        unlocked: false,
-        wrappedKeyPresent: wrappedState.wrapped !== null,
-        migrationRequired: Boolean(wrappedState.migrationRequired),
-        keyPath: command.keyPath,
-        socketPath: command.socketPath,
-        idleTimeoutMs: command.idleTimeoutMs,
-        idleRemainingMs: 0
-      }
-    };
-  }
-  return {
-    ok: false,
-    code: "unlock_failed",
-    message: error instanceof Error ? error.message : String(error),
-    status: {
-      running: true,
-      unlocked: false,
-      wrappedKeyPresent: wrappedState.wrapped !== null,
-      migrationRequired: Boolean(wrappedState.migrationRequired),
-      keyPath: command.keyPath,
-      socketPath: command.socketPath,
-      idleTimeoutMs: command.idleTimeoutMs,
-      idleRemainingMs: 0
-    }
-  };
-}
-function handleTreeseedKeyAgentCommand(command, session) {
-  maybeExpireSession(session);
-  if (command.command === "health") {
-    return ok({
-      status: createStatus(command, session)
-    });
-  }
-  if (command.command === "status") {
-    return ok({ status: createStatus(command, session) });
-  }
-  if (command.command === "lock") {
-    session.machineKey = null;
-    return ok({ status: createStatus(command, session) });
-  }
-  if (command.command === "touch") {
-    if (!session.machineKey) {
-      return fail(new TreeseedKeyAgentError("locked", "Treeseed secret session is locked."), command);
-    }
-    session.lastTouchedAt = Date.now();
-    return ok({ status: createStatus(command, session) });
-  }
-  if (command.command === "unlock") {
-    try {
-      session.machineKey = unwrapOrProvisionMachineKey(command);
-      session.lastTouchedAt = Date.now();
-      session.idleTimeoutMs = command.idleTimeoutMs;
-      return ok({ status: createStatus(command, session) });
-    } catch (error) {
-      return fail(error, command);
-    }
-  }
-  if (!session.machineKey) {
-    return fail(new TreeseedKeyAgentError("locked", "Treeseed secret session is locked."), command);
-  }
-  session.lastTouchedAt = Date.now();
-  return ok({
-    status: createStatus(command, session),
-    machineKey: session.machineKey.toString("base64")
-  });
-}
-async function requestTreeseedKeyAgent(command) {
-  const diagnostics = await inspectTreeseedKeyAgentDiagnostics(command.socketPath);
-  if (!diagnostics.healthOk && command.command !== "health") {
-    throw new TreeseedKeyAgentError("daemon_unavailable", diagnostics.lastError ?? "Treeseed key-agent is not running.", { diagnostics });
-  }
-  return requestTreeseedKeyAgentOverSocket(command);
-}
-async function socketAlreadyServed(socketPath) {
-  const diagnostics = await inspectTreeseedKeyAgentDiagnostics(socketPath);
-  return diagnostics.socketConnectable && diagnostics.healthOk;
-}
-async function removeStaleSocket(socketPath) {
-  if (!existsSync(socketPath)) {
-    return true;
-  }
-  const socketKind = detectSocketKind(socketPath);
-  if (socketKind !== "socket") {
-    rmSync(socketPath, { force: true });
-    clearPidFile(socketPath);
-    return true;
-  }
-  const diagnostics = await inspectTreeseedKeyAgentDiagnostics(socketPath);
-  if (diagnostics.socketConnectable && diagnostics.healthOk) {
-    return false;
-  }
-  rmSync(socketPath, { force: true });
-  clearPidFile(socketPath);
-  return true;
-}
-async function startTreeseedKeyAgentServer(options) {
-  const socketPath = options.socketPath ?? getTreeseedKeyAgentPaths().socketPath;
-  const canStart = await removeStaleSocket(socketPath);
-  if (!canStart) {
-    return;
-  }
-  ensureParent(socketPath);
-  const session = {
-    machineKey: null,
-    lastTouchedAt: 0,
-    idleTimeoutMs: options.idleTimeoutMs ?? TRESEED_KEY_AGENT_IDLE_TIMEOUT_MS
-  };
-  const cleanup = () => {
-    try {
-      rmSync(socketPath, { force: true });
-      clearPidFile(socketPath);
-    } catch {
-    }
-  };
-  const server = createServer((connection) => {
-    let requestBuffer = "";
-    connection.setEncoding("utf8");
-    connection.on("data", (chunk) => {
-      requestBuffer += chunk;
-      const newlineIndex = requestBuffer.indexOf("\n");
-      if (newlineIndex === -1) {
-        return;
-      }
-      const line = requestBuffer.slice(0, newlineIndex).trim();
-      requestBuffer = "";
-      let response;
-      try {
-        const parsed = JSON.parse(line);
-        response = handleTreeseedKeyAgentCommand(parsed, session);
-      } catch (error) {
-        response = fail(error, {
-          command: "status",
-          keyPath: options.keyPath,
-          socketPath,
-          idleTimeoutMs: options.idleTimeoutMs ?? TRESEED_KEY_AGENT_IDLE_TIMEOUT_MS
-        });
-      }
-      connection.end(`${JSON.stringify(response)}
-`);
-    });
-    connection.on("error", () => {
-      connection.destroy();
-    });
-  });
-  await new Promise((resolvePromise, rejectPromise) => {
-    server.once("error", (error) => {
-      rejectPromise(error);
-    });
-    server.listen(socketPath, () => {
-      chmodSync(socketPath, 384);
-      writePidFile(socketPath);
-      resolvePromise();
-    });
-  });
-  process.on("exit", cleanup);
-  process.on("SIGINT", () => {
-    cleanup();
-    process.exit(0);
-  });
-  process.on("SIGTERM", () => {
-    cleanup();
-    process.exit(0);
-  });
-  await new Promise(() => {
-  });
-  server.close();
-}
-function assertTreeseedKeyAgentResponse(response, fallback = "Treeseed secret session request failed.") {
-  if (response.ok) {
-    return response;
-  }
-  throw new TreeseedKeyAgentError(
-    response.code ?? "unlock_failed",
-    response.message ?? fallback,
-    {
-      status: response.status,
-      diagnostics: response.diagnostics
-    }
-  );
-}
-function rotateWrappedMachineKeyPassphrase(keyPath, machineKey, passphrase) {
-  return replaceWrappedMachineKey(keyPath, machineKey, passphrase);
-}
-function migrateLegacyProjectMachineKeyToWrapped(keyPath, legacyKeyPath, passphrase) {
-  const legacyProjectKey = readLegacyProjectMachineKey(legacyKeyPath);
-  if (!legacyProjectKey) {
-    throw new TreeseedKeyAgentError(
-      "wrapped_key_migration_required",
-      "No legacy project machine key is available to migrate.",
-      { legacyKeyPath }
-    );
-  }
-  const wrapped = replaceWrappedMachineKey(keyPath, legacyProjectKey, passphrase);
-  if (legacyKeyPath !== keyPath) {
-    rmSync(legacyKeyPath, { force: true });
-  }
-  return wrapped;
-}
-function machineKeysEqual(left, right) {
-  return left.length === right.length && timingSafeEqual(left, right);
-}
-export {
-  TREESEED_KEY_AGENT_IDLE_TIMEOUT_MS,
-  TREESEED_MACHINE_KEY_PASSPHRASE_ENV,
-  TRESEED_KEY_AGENT_IDLE_TIMEOUT_MS,
-  TRESEED_MACHINE_KEY_PASSPHRASE_ENV,
-  TRESEED_WRAPPED_MACHINE_KEY_KIND,
-  TRESEED_WRAPPED_MACHINE_KEY_VERSION,
-  TreeseedKeyAgentError,
-  assertTreeseedKeyAgentResponse,
-  getTreeseedKeyAgentPaths,
-  handleTreeseedKeyAgentCommand,
-  inspectTreeseedKeyAgentDiagnostics,
-  machineKeysEqual,
-  migrateLegacyProjectMachineKeyToWrapped,
-  readWrappedMachineKeyFile,
-  replaceWrappedMachineKey,
-  requestTreeseedKeyAgent,
-  rotateWrappedMachineKeyPassphrase,
-  startTreeseedKeyAgentServer,
-  unwrapMachineKey,
-  writeWrappedMachineKeyFile
-};

package/dist/operations/services/live-hosted-service-checks.d.ts

@@ -1,30 +0,0 @@
-import { type TreeseedHostedServiceCheckReport, type TreeseedHostedServiceTarget } from './hosted-service-checks.js';
-export interface TreeseedLiveHostedServiceCheckOptions {
-    tenantRoot: string;
-    target: TreeseedHostedServiceTarget;
-    appId?: string;
-    serviceKeys?: string[];
-    strict?: boolean;
-    requireLiveRailway?: boolean;
-    requireLiveHttp?: boolean;
-    timeoutMs?: number;
-    retry?: {
-        attempts: number;
-        intervalMs: number;
-    };
-    httpRetry?: {
-        attempts: number;
-        intervalMs: number;
-    };
-    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
-    fetchImpl?: typeof fetch;
-}
-export interface TreeseedLiveHostedServiceCheckReport extends TreeseedHostedServiceCheckReport {
-    live: true;
-    liveObservation: {
-        railway: 'observed' | 'skipped' | 'failed';
-        http: 'observed' | 'skipped' | 'failed';
-        issues: string[];
-    };
-}
-export declare function collectTreeseedLiveHostedServiceChecks(options: TreeseedLiveHostedServiceCheckOptions): Promise<TreeseedLiveHostedServiceCheckReport>;