/**
 * ECR image publisher for `ecs publish`.
 *
 * Logs in to ECR with the local AWS credentials (GetAuthorizationToken),
 * builds/tags/pushes the image with the docker CLI, and resolves the pushed
 * image digest via DescribeImages so the task definition can pin the image
 * by digest. The registry password is always passed over stdin
 * (`--password-stdin`), never on the command line.
 */
import { ECRClient } from '@aws-sdk/client-ecr';
export interface PublishImageOptions {
    /** ECR repository URI (push destination) */
    repositoryUri: string;
    /** Image tag to push */
    tag: string;
    /** Dockerfile used for the build (docker default when omitted) */
    dockerfile?: string;
    /** Pre-built local image to push (skips the build step) */
    image?: string;
    /** Build context directory (default: current directory) */
    contextDir?: string;
}
export interface PublishedImage {
    /** Digest-pinned image URI (`<repositoryUri>@sha256:...`) */
    imageUri: string;
    imageTag: string;
    imageDigest: string;
}
/**
 * Run a docker CLI command. Output is streamed to the terminal.
 * When `input` is provided it is written to the child's stdin (used for
 * `docker login --password-stdin` so the password never appears in argv).
 */
export declare function runDocker(args: string[], input?: string): Promise<void>;
/**
 * Log in the local docker CLI to the ECR registry using GetAuthorizationToken.
 * The decoded password is piped to `docker login --password-stdin`.
 */
export declare function loginToEcr(client: ECRClient, registry: string): Promise<void>;
/**
 * Resolve the digest of a pushed image tag via DescribeImages.
 */
export declare function getImageDigest(client: ECRClient, repositoryName: string, tag: string): Promise<string>;
/**
 * Build (unless a local image is given), tag, and push the image to ECR,
 * then return the digest-pinned image URI.
 */
export declare function publishImage(options: PublishImageOptions): Promise<PublishedImage>;
//# sourceMappingURL=ecr-publisher.d.ts.map