/**
 * ECS task definition registrar for `ecs publish`.
 *
 * Registers a Fargate task definition for the ECS execution agent:
 * - image pinned by digest (`<repo>@sha256:...`)
 * - awslogs log driver (log group created when missing)
 * - NO environment variables in the task definition — COMMAND_ID, the
 *   oneshot token, etc. are injected per run via containerOverrides.
 */
import { CloudWatchLogsClient } from '@aws-sdk/client-cloudwatch-logs';
export interface RegisterEcsTaskDefinitionOptions {
    /** Task definition family: ai-support-ecs-agent-{tenantCode}-{agentId} */
    family: string;
    /** Digest-pinned image URI */
    imageUri: string;
    cpu: number;
    memory: number;
    region: string;
    logGroupName: string;
    /** Task execution role (required by Fargate for ECR pull / awslogs) */
    executionRoleArn?: string;
    /** Task role assumed by the container itself */
    taskRoleArn?: string;
    /**
     * When true, adds a `tailscale` sidecar container (see admin-docs
     * docs/specifications/ssh-tailscale-support.md, section 2) that the main
     * (`ECS_AGENT_CONTAINER_NAME`) container depends on being `HEALTHY` before
     * it starts. Required for ECS execution agents that may run
     * `ssh_exec`/`server_setup_exec` against a `connectionType: 'tailscale'`
     * host. Defaults to `false` — omitting it (or passing `false`) registers
     * the exact same single-container task definition as before, unchanged.
     */
    enableTailscale?: boolean;
    /**
     * When true, registers the main container with a read-only root filesystem
     * and provisions two writable ephemeral (Fargate scratch) volumes mounted at
     * `/tmp` and `/workspace` so the agent's temp dir (SSH key JIT) and the
     * ansible workspace still work. Opt-in server-setup hardening — omitting it
     * leaves the container fully writable as before.
     */
    readonlyRootFilesystem?: boolean;
    /** Non-root user (uid, `uid:gid`, or username) to run the main container as. */
    user?: string;
    /** Linux capabilities to drop from the main container (e.g. `['ALL']`). */
    dropCapabilities?: string[];
}
export interface RegisteredTaskDefinition {
    taskDefinitionArn: string;
    family: string;
    revision: number;
}
/**
 * Create the awslogs log group when it does not exist.
 * ResourceAlreadyExistsException is tolerated (idempotent).
 */
export declare function ensureLogGroup(client: CloudWatchLogsClient, logGroupName: string): Promise<void>;
/**
 * Register the Fargate task definition and return its ARN.
 */
export declare function registerTaskDefinition(options: RegisterEcsTaskDefinitionOptions): Promise<RegisteredTaskDefinition>;
//# sourceMappingURL=task-definition-registrar.d.ts.map