export declare const CLOUD_PROVIDERS: readonly ["aws", "gcp", "azure", "cloudflare", "mongodb_atlas", "neo4j_aura"];
export type CloudProviderName = (typeof CLOUD_PROVIDERS)[number];
export type GuidePurpose = 'resources' | 'deploy';
export interface IConnectionFlags {
    provider?: string;
    name?: string;
    tag?: string;
    description?: string;
    scopes?: string;
    authMode?: string;
    deploy?: boolean;
    projectId?: string;
    serviceAccountFile?: string;
    runtimeServiceAccount?: string;
    roleArn?: string;
    runtimeRoleArn?: string;
    buildRoleArn?: string;
    defaultRegion?: string;
    /** The outputs of the ductape-fargate stack as saved by `aws cloudformation describe-stacks`, read from a file; the individual flags below win over it. */
    fargateOutputsFile?: string;
    fargateCluster?: string;
    fargateListenerArn?: string;
    fargateBaseDomain?: string;
    fargateVpcId?: string;
    fargateSubnets?: string;
    fargateSecurityGroups?: string;
    fargateTaskRoleArn?: string;
    fargateExecutionRoleArn?: string;
    fargateLogGroup?: string;
    fargatePrivateTasks?: boolean;
    /** `on` or `off`: scale releases that no longer serve to zero tasks (never deleted). */
    fargateScaleDownIdle?: string;
    /** `on` or `off`: the load balancer is internal, so releases are checked from inside the network through the relay function. */
    fargateInternal?: string;
    /** The relay function (the ductape-fargate stack's VerifierFunctionName output). Needed when the load balancer is internal. */
    fargateVerifierFunction?: string;
    /** ECS Express Mode: the role AWS uses to build the load balancer (the ductape-ecs-express stack's InfrastructureRoleArn output). */
    expressInfrastructureRoleArn?: string;
    /** The saved output of `aws cloudformation describe-stacks --stack-name ductape-ecs-express`. */
    expressOutputsFile?: string;
    tenantId?: string;
    subscriptionId?: string;
    clientId?: string;
    clientSecretEnv?: string;
    defaultLocation?: string;
    resourceGroup?: string;
    registryName?: string;
    runtimeIdentityId?: string;
    environmentName?: string;
    keyVaultUri?: string;
    accountId?: string;
    apiTokenEnv?: string;
    /** Cloudflare Secrets Store that { secret: NAME } references are bound from; empty clears it. */
    secretsStoreId?: string;
    atlasPublicKey?: string;
    atlasPrivateKeyEnv?: string;
    auraClientId?: string;
    auraClientSecretEnv?: string;
    auraInstanceId?: string;
}
export interface IConnectionIo {
    readFile(path: string): string;
    env: Record<string, string | undefined>;
}
export declare const realIo: IConnectionIo;
/**
 * The Fargate fields of a connection: from the saved outputs of the setup stack, then any individual flag on top. Accepts what
 * `aws cloudformation describe-stacks --stack-name ductape-fargate` prints, the bare list of outputs, or a plain object of them.
 */
export declare function fargateFields(flags: IConnectionFlags, io: IConnectionIo): Record<string, unknown>;
/**
 * Builds the request body for `ductape cloud connections <verb>` from flags, on top of any body read from a file. Flags win.
 * Nothing secret is accepted as a flag value.
 */
export declare function buildConnectionBody(verb: string, flags: IConnectionFlags, base?: Record<string, unknown>, io?: IConnectionIo): Record<string, unknown>;
export interface IGuideStep {
    step: number;
    /** "you" runs it in their own cloud account or terminal; "ductape" is a ductape command. */
    who: 'you' | 'ductape';
    title: string;
    commands?: string[];
    notes?: string[];
    /** Console pages that do the step without a terminal. */
    links?: Array<{
        label: string;
        url: string;
    }>;
}
export interface IConnectionGuide {
    provider: CloudProviderName;
    purpose: GuidePurpose;
    supported: boolean;
    summary: string;
    secrets: string;
    steps: IGuideStep[];
    /** Roles and APIs the connection needs, when the purpose is deploy. */
    access?: {
        roles: Array<{
            role: string;
            for: string;
        }>;
        apis: string[];
    };
    /** What a deploy connection will make in the customer's project, so nothing is a surprise. */
    creates?: string[];
    /** Errors people meet during setup, and what fixes each. */
    troubleshooting?: Array<{
        problem: string;
        fix: string;
    }>;
    /** An optional second path on the same connection, such as Fargate on top of Lambda. */
    optional?: Array<{
        title: string;
        summary: string;
        steps: IGuideStep[];
        creates: string[];
        limits: string[];
        troubleshooting: Array<{
            problem: string;
            fix: string;
        }>;
    }>;
    /** What to do once the connection is active. */
    next?: string[];
}
export declare const GCP_DEPLOY_ROLE_LIST: {
    role: string;
    for: string;
}[];
/** Everything a deploy through a GCP connection leaves in the customer's project. All of it is labelled as Ductape's. */
export declare const GCP_DEPLOY_CREATES: string[];
export declare const GCP_DEPLOY_SAFETY = "Ductape only adds resources it labels as its own (ductape_managed), never changes or reuses one it did not create, and never deletes anything, including what it created. Removing deployed resources is always your own action. Use a dedicated project if you can, so what Ductape adds is easy to see.";
export declare const GCP_DEPLOY_TROUBLESHOOTING: {
    problem: string;
    fix: string;
}[];
export declare const AWS_DEPLOY_ROLE_LIST: {
    role: string;
    for: string;
}[];
export declare const AWS_DEPLOY_CREATES: string[];
export declare const AWS_DEPLOY_SAFETY = "Ductape only adds resources it tags as its own (ductape_managed), never changes or reuses one it did not create, and never deletes anything, including what it created. Removing deployed resources is always your own action. Use a dedicated account if you can, so what Ductape adds is easy to see.";
export declare const AWS_DEPLOY_TROUBLESHOOTING: {
    problem: string;
    fix: string;
}[];
/**
 * Extra steps for a connection that also deploys to AWS Fargate. Lambda needs none of this; Fargate runs your containers behind a load balancer
 * in your account, so it needs a cluster, a certificate for a domain you own, and the permissions to manage them.
 */
export declare const AWS_FARGATE_OPTIONAL: NonNullable<IConnectionGuide['optional']>[number];
/** Extra steps for a connection that also deploys to ECS Express Mode. It builds on the Fargate stack and changes what is guaranteed, which the steps say plainly. */
export declare const AWS_EXPRESS_OPTIONAL: NonNullable<IConnectionGuide['optional']>[number];
export declare const AZURE_DEPLOY_ROLE_LIST: {
    role: string;
    for: string;
}[];
export declare const AZURE_DEPLOY_CREATES: string[];
export declare const AZURE_DEPLOY_SAFETY = "Ductape only adds resources it tags as its own (ductape_managed), never changes or reuses one it did not create, and never deletes anything, including what it created. It never registers resource providers or changes anything outside the one resource group. Removing deployed resources is always your own action.";
export declare const AZURE_DEPLOY_TROUBLESHOOTING: {
    problem: string;
    fix: string;
}[];
export declare const CLOUDFLARE_DEPLOY_ROLE_LIST: {
    role: string;
    for: string;
}[];
export declare const CLOUDFLARE_DEPLOY_CREATES: string[];
export declare const CLOUDFLARE_DEPLOY_SAFETY = "Ductape only adds resources it tags as its own (ductape_managed), never changes or reuses one it did not create, and never deletes anything, including what it created. Removing deployed Workers is always your own action. A Worker has no cloud-level access check in front of it: the function's own signature check, which every call must pass, is the access control. Only functions can run on Workers, not services, and only TypeScript functions.";
export declare const CLOUDFLARE_DEPLOY_TROUBLESHOOTING: {
    problem: string;
    fix: string;
}[];
export declare const GCP_DEPLOY_APIS: string[];
export declare function connectionGuide(providerInput: string, purposeInput?: string): IConnectionGuide;
/** A copy of a request body that is safe to print: secrets and key material are replaced, everything else is kept. */
export declare function maskConnectionBody(body: Record<string, unknown>): Record<string, unknown>;