/**
 * Deployment manifest generation for multi-replica agent deployments.
 *
 * Produces a Kubernetes Deployment (+ Secret) or an ECS task definition (+
 * service definition) that runs N replicas of the agent CLI from **one** agent
 * token. All replicas register as the same logical agent and are told apart by
 * their instance id, so scaling out never means registering another agent.
 *
 * The generators are pure string builders with no filesystem or network access
 * so they can be unit-tested and reused verbatim by the web UI.
 */
/** Container image used when the caller does not pass one. */
export declare const DEFAULT_AGENT_IMAGE = "ghcr.io/mbc-net/ai-support-agent-cli:latest";
/** Kubernetes Secret / Deployment name used when the caller does not pass one. */
export declare const DEFAULT_K8S_NAME = "ai-support-agent";
/** ECS task definition family used when the caller does not pass one. */
export declare const DEFAULT_ECS_FAMILY = "ai-support-agent";
/**
 * One project's deployment unit.
 *
 * Each project needs its own token: the agentId is derived from the token's
 * tokenId (see resolveAgentId in agent-runner.ts), so sharing one token across
 * projects makes their agentIds collide and the server's TOFU binding rejects
 * the connection.
 */
export interface ManifestProject {
    /** Project code (UPPER_SNAKE_CASE). */
    projectCode: string;
    /** Agent token for this project. Embedded in a Secret, never in args. */
    token: string;
    /** Resource name. Defaults to the shared default; duplicates are rejected. */
    name?: string;
    /** Desired replica count. Defaults to 1. */
    replicas?: number;
}
export interface ManifestInput {
    /** Tenant code (lower_snake_case). */
    tenantCode: string;
    /** API base URL the agent connects to. */
    apiUrl: string;
    /** Container image. */
    image?: string;
    /** Resource name (Deployment / Secret / task family). */
    name?: string;
    /** Project code (UPPER_SNAKE_CASE). */
    projectCode?: string;
    /** Agent token. Embedded in a Secret / Secrets Manager reference, never in args. */
    token?: string;
    /** Desired replica count. */
    replicas?: number;
    /**
     * Mutually exclusive with projectCode/token. Specifying both makes it
     * impossible to tell which form produced the output, so it is an error
     * rather than a silent precedence rule.
     */
    projects?: ManifestProject[];
}
export interface K8sManifestInput extends ManifestInput {
    namespace?: string;
}
export interface EcsManifestInput extends ManifestInput {
    /** ECS cluster name (used in the service definition). */
    cluster: string;
    subnets: string[];
    securityGroups: string[];
    /** CloudWatch Logs group for the awslogs driver. */
    logGroup?: string;
    /** Task execution role ARN (required to pull images / write logs). */
    executionRoleArn?: string;
    taskRoleArn?: string;
    region?: string;
    cpu?: string;
    memory?: string;
    assignPublicIp?: boolean;
}
/** Thrown when the requested replica count is not allowed. */
export declare class ReplicaLimitExceededError extends Error {
    readonly requested: number;
    readonly maxReplicas: number;
    constructor(requested: number, maxReplicas: number);
}
/**
 * Validate a replica count against the plan limit.
 *
 * `maxReplicas === null` means unlimited. Generating a manifest that exceeds
 * the limit is refused up front rather than left to fail at runtime: the extra
 * replicas would start, be denied a slot, and sit in standby forever, which
 * looks like a broken deployment rather than a quota decision.
 */
export declare function assertReplicasWithinLimit(replicas: number, maxReplicas: number | null): void;
/**
 * Thrown when a Kubernetes object name is not a DNS-1123 label.
 *
 * A named class (rather than a bare Error) so tests can assert the failure
 * reason. `toThrow(SomeUndefinedImport)` silently degrades to "threw
 * anything", which lets a test pass while verifying nothing — the web side
 * (agent-deploy-manifest.ts) already exports the same class for this reason.
 */
export declare class InvalidManifestNameError extends Error {
    readonly field: string;
    readonly value: string;
    constructor(field: string, value: string);
}
/**
 * Generate a Kubernetes Secret + Deployment.
 *
 * The token goes into a Secret (never into `args`, where it would be visible
 * in `kubectl get pod -o yaml` and in every process listing inside the node).
 * `AI_SUPPORT_AGENT_INSTANCE_ID` is bound to the Pod name via the downward API
 * so each replica has a stable, human-recognizable identity in the admin UI.
 */
export declare class ManifestProjectSelectionError extends Error {
    constructor(message: string);
}
export declare function generateK8sManifest(input: K8sManifestInput): string;
export declare function generateEcsManifest(input: EcsManifestInput): {
    taskDefinition: string;
    service: string;
};
//# sourceMappingURL=manifest-generator.d.ts.map