/**
 * `ecs publish` CLI command.
 *
 * Publishes an ECS execution agent (launcher-agent architecture):
 *   1. Build (or reuse) the image, push it to ECR, resolve its digest
 *      — all with the LOCAL AWS credentials (the API never calls AWS).
 *   2. Register a Fargate task definition pinned to that digest
 *      (awslogs driver, NO environment variables in the definition).
 *   3. Register the agent with the API
 *      (POST /api/:tenantCode/agent/ecs-agents, agent Bearer token).
 *
 * The agentId (`ecs-{uuid}`) is generated on first publish and persisted in
 * the project config keyed by the ECR repository URI, so a re-publish
 * (image update) overwrites the same agent with a new task definition
 * revision instead of creating a new one.
 */
import { Command } from 'commander';
import type { ProjectRegistration } from '../types';
export interface EcsPublishCliOptions {
    repositoryUri: string;
    tag: string;
    cluster: string;
    subnets: string[];
    securityGroups: string[];
    dockerfile?: string;
    image?: string;
    cpu?: string;
    memory?: string;
    name?: string;
    assignPublicIp?: boolean;
    logGroup?: string;
    executionRole?: string;
    taskRole?: string;
    launcherAgentId?: string;
    project?: string;
    /**
     * ECS container isolation (opt-in — omitting all three registers the exact
     * same task definition as before). Intended for server-setup execution
     * agents so a compromised custom Ansible task cannot persist to the
     * container's root filesystem, run as root, or retain Linux capabilities.
     */
    readonlyRootfs?: boolean;
    runAsUser?: string;
    dropCapabilities?: string[];
}
/**
 * Parse `--run-as-user` into the ECS `user` field. Accepts a bare uid, a
 * `uid:gid`, or a plain username — passed through to ECS verbatim after a light
 * shape check (letters/digits/underscore/hyphen, optionally a single `:`).
 */
export declare function parseRunAsUser(value: string | undefined): string | undefined;
/**
 * Resolve the target project registration.
 * `--project tenantCode/projectCode` selects one; when omitted the single
 * registered project is used (ambiguity is an error, no fallback).
 */
export declare function resolveTargetProject(projects: ProjectRegistration[], projectFlag?: string): ProjectRegistration;
/**
 * Orchestrate the full publish flow. Throws on failure; the commander action
 * wrapper converts failures into a non-zero exit code.
 */
export declare function runEcsPublish(opts: EcsPublishCliOptions): Promise<void>;
export declare function registerEcsCommands(program: Command): void;
//# sourceMappingURL=ecs-publish-command.d.ts.map