import { type ChildEnvPolicy } from "@fjall/util";
import type { CdkContext, CdkOptions } from "./CdkService.js";
export declare class CdkArgumentBuilder {
    private readonly childEnvPolicy;
    /**
     * How the CDK child inherits this process's environment.
     *
     * REQUIRED, and deliberately not defaulted: the CDK child executes the
     * customer's own `infrastructure.ts` (cdk.json's `app` is
     * `npx tsx infrastructure.ts`, run through a shell by the CDK CLI). On an
     * operator's laptop that is the operator's own code and `inherit` is right;
     * in the multi-tenant deploy worker it is a tenant's code running beside
     * another tenant's secrets, and only `isolate` is. A default would pick one
     * of those for every future caller silently.
     */
    constructor(childEnvPolicy: ChildEnvPolicy);
    /** The policy this builder was constructed with, for sibling spawn sites. */
    get envPolicy(): ChildEnvPolicy;
    buildContextArgs(context?: CdkContext): string[];
    /**
     * Emit `--parameters [stackName:]key=value` pairs for every entry in the
     * supplied record. Returns an empty array when the record is undefined or
     * empty so the caller can unconditionally spread the result into argv.
     *
     * When `stackName` is supplied, each parameter is scoped to that stack
     * (`Stack:Key=Value`). This is REQUIRED for single-stack deploys: the cdk
     * CLI applies an unqualified `--parameters Key=Value` to EVERY stack in the
     * deploy set — including dependency stacks it pulls in upstream — so a
     * parameter declared only on the compute stack makes CloudFormation reject
     * "Parameters: [...] do not exist in the template" on the network/database
     * stacks. Omit `stackName` only for `--all` deploys, where scoping to one
     * stack is impossible and the unqualified form is the only valid one.
     *
     * Keys must match CloudFormation's parameter-name shape
     * (`^[A-Za-z][A-Za-z0-9]*$`). Values must be non-empty and free of `,`
     * (cdk's parameter-list separator) and newlines (which would break argv).
     * The `stackName:` qualifier is folded into the emitted value AFTER key
     * validation, so the colon never trips the key regex.
     */
    buildParameterArgs(parameters?: Record<string, string>, stackName?: string): string[];
    injectCascadeCredentials(env: NodeJS.ProcessEnv, credentials?: CdkOptions["credentials"]): void;
    /**
     * Build the CDK subprocess environment.
     *
     * `ENVIRONMENT` is set from the resolved context — and MUST be, not merely
     * defaulted. The constructs package resolves the environment through two
     * readers with OPPOSITE precedence: `getEnvironment()` (utils/env.ts, pre-App)
     * reads `process.env.ENVIRONMENT` first and `-c environment=` second, while
     * `getConfig()` (utils/getConfig.ts, App-scoped) reads `-c environment=`
     * first and `process.env.ENVIRONMENT` last. Supplying only one channel lets
     * an ambient `ENVIRONMENT` in the operator's shell win in one reader and lose
     * in the other, so the same synth can classify a stack two different ways.
     * Writing both makes them agree unconditionally and overwrites whatever the
     * shell happened to export — which is the point: deploy-core resolved this
     * account's stage from the org config, and that answer is authoritative.
     */
    buildCdkEnv(options?: {
        context?: {
            region?: string;
            accountId?: string;
            environment?: string;
        };
        credentials?: CdkOptions["credentials"];
    }): NodeJS.ProcessEnv;
}