import { Role, Role_Policy, Runtime, RuntimeEndpoint, Memory, BedrockAgentCoreGateway, GatewayTarget, WorkloadIdentity } from "../generated/index.js";
/**
 * Managed language runtimes AgentCore can run a code-config zip on. Inlined
 * from the generated `Runtime_AgentManagedRuntimeType` CFN enum (which the
 * generated barrel exports as a type declaration only), matching how
 * `protocolConfiguration`/`gatewayAuthorizerType` inline their enums below.
 */
export type AgentManagedRuntime = "NODE_22" | "PYTHON_3_10" | "PYTHON_3_11" | "PYTHON_3_12" | "PYTHON_3_13" | "PYTHON_3_14";
import { type SubIntrinsic } from "../intrinsics.js";
/**
 * ARN of the managed `DEFAULT` endpoint AgentCore provisions with a Runtime,
 * as an `Fn::Sub` over the Runtime's ARN. No CloudFormation attribute carries
 * it (the Runtime schema exposes only `AgentRuntimeArn`/`AgentRuntimeId`/
 * `AgentRuntimeVersion`/`Status`), but the format is fixed by the
 * CreateAgentRuntimeEndpoint API:
 * `arn:aws:bedrock-agentcore:<region>:<account>:runtime/<id>/runtime-endpoint/<name>`.
 */
export declare function agentCoreDefaultEndpointArn(runtime: InstanceType<typeof Runtime>): SubIntrinsic;
/**
 * Bedrock AgentCore's real limits, verified against the CloudFormation
 * registry schema for `AWS::BedrockAgentCore::{Runtime,RuntimeEndpoint,Memory}`
 * (#882).
 *
 * Exported for the same reason as `MICROVM_LIMITS` (#1374, #1420): a
 * consumer driving AgentCore through another control plane needs the same
 * numbers, and copying them is how two sources of truth start.
 */
export declare const AGENTCORE_LIMITS: {
    /**
     * `Runtime`/`RuntimeEndpoint`/`Memory` `Name`/`AgentRuntimeName` fields
     * are bound to this pattern — no hyphens, unlike chant's usual kebab-case
     * component names. `Gateway`/`GatewayTarget`/`WorkloadIdentity` names
     * accept hyphens, so only the Runtime family needs sanitizing.
     */
    readonly runtimeNamePattern: RegExp;
    readonly maxRuntimeNameLength: 48;
    /** `Memory` event retention bounds, in days. */
    readonly memoryEventExpiryDays: {
        readonly min: 3;
        readonly max: 365;
        readonly default: 30;
    };
};
/**
 * Managed-runtime code artifact — the S3-zip alternative to `containerUri`.
 * Mirrors CFN `Runtime.CodeConfiguration`: AgentCore runs a zipped agent on
 * a managed language runtime, no container image to build or host. This is
 * how a Strands agent actually ships (a Python zip in S3), which is why the
 * composite offers it alongside the container path.
 */
export interface AgentCoreCodeArtifact {
    /** S3 bucket holding the agent's zipped code. */
    s3Bucket: string;
    /** S3 key (or prefix) of the zip within `s3Bucket`. */
    s3Prefix: string;
    /** Optional S3 object version id, pinning a specific upload. */
    s3VersionId?: string;
    /** Managed runtime the zip runs on, e.g. `"PYTHON_3_12"`. Mirrors the generated CFN enum. */
    runtime: AgentManagedRuntime;
    /** Entry point, 1-2 items — e.g. `["app.py"]` or `["python", "app.py"]` (CFN bounds the list to 2). */
    entryPoint: string[];
}
export interface AgentCoreAgentProps {
    /**
     * Base name for the agent's resources. `toRuntimeIdentifier(name)` derives
     * the Runtime/Memory (and any explicit endpoint) names; Gateway/GatewayTarget/
     * WorkloadIdentity use `name` as-is (hyphens are valid there).
     */
    name: string;
    /**
     * ECR image URI the Runtime runs, e.g. `"123456789012.dkr.ecr.us-east-1.amazonaws.com/agent:latest"`.
     * Supply exactly one of `containerUri` or `code`.
     */
    containerUri?: string;
    /**
     * S3-zip code artifact run on a managed runtime — the alternative to
     * `containerUri`. Supply exactly one of the two.
     */
    code?: AgentCoreCodeArtifact;
    /** Runtime network mode. Default: "PUBLIC". */
    networkMode?: "PUBLIC" | "VPC";
    /** Subnets for the Runtime's ENIs. Required when `networkMode` is "VPC". */
    vpcSubnetIds?: string[];
    /** Security groups for the Runtime's ENIs. Required when `networkMode` is "VPC". */
    vpcSecurityGroupIds?: string[];
    /** Protocol the Runtime serves. Mirrors the generated `Runtime_ProtocolConfiguration` CFN enum. Default: "MCP". */
    protocolConfiguration?: "A2A" | "AGUI" | "HTTP" | "MCP";
    /** Environment variables passed to the Runtime container. */
    environmentVariables?: Record<string, string>;
    /**
     * Name of an explicit, non-`DEFAULT` `RuntimeEndpoint` to create alongside
     * the Runtime (e.g. `"PROD"`), the alias a version-promotion flow would
     * later repoint (deferred, see #882). Omit it and no endpoint resource is
     * created: AgentCore provisions a managed `DEFAULT` endpoint with every
     * Runtime, and it tracks the latest version on its own. `"DEFAULT"` is
     * rejected, since a CloudFormation endpoint of that name duplicates the
     * managed one and fails on a real apply (#978, see the composite doc).
     */
    endpointName?: string;
    /** Memory event retention, in days. Bounds: {@link AGENTCORE_LIMITS.memoryEventExpiryDays}. */
    memoryEventExpiryDays?: number;
    /** Gateway authorizer. Mirrors the generated `BedrockAgentCoreGateway_AuthorizerType` CFN enum. Default: "AWS_IAM". */
    gatewayAuthorizerType?: "CUSTOM_JWT" | "AWS_IAM" | "NONE" | "AUTHENTICATE_ONLY";
    /** Allow-listed OAuth2 return URLs for the standalone `WorkloadIdentity` resource. */
    allowedResourceOauth2ReturnUrls?: string[];
    /** Extra managed policy ARNs merged onto the auto-created Runtime/Memory execution role. */
    ManagedPolicyArns?: string[];
    /** Inline policies attached to the auto-created Runtime/Memory execution role. */
    Policies?: InstanceType<typeof Role_Policy>[];
    defaults?: {
        role?: Partial<ConstructorParameters<typeof Role>[0]>;
        gatewayRole?: Partial<ConstructorParameters<typeof Role>[0]>;
        runtime?: Partial<ConstructorParameters<typeof Runtime>[0]>;
        endpoint?: Partial<ConstructorParameters<typeof RuntimeEndpoint>[0]>;
        memory?: Partial<ConstructorParameters<typeof Memory>[0]>;
        gateway?: Partial<ConstructorParameters<typeof BedrockAgentCoreGateway>[0]>;
        gatewayTarget?: Partial<ConstructorParameters<typeof GatewayTarget>[0]>;
        workloadIdentity?: Partial<ConstructorParameters<typeof WorkloadIdentity>[0]>;
    };
}
export type AgentCoreAgentResult = {
    role: InstanceType<typeof Role>;
    gatewayRole: InstanceType<typeof Role>;
    runtime: InstanceType<typeof Runtime>;
    /** Present only when `endpointName` names an explicit non-DEFAULT endpoint (#978). */
    endpoint?: InstanceType<typeof RuntimeEndpoint>;
    memory: InstanceType<typeof Memory>;
    workloadIdentity: InstanceType<typeof WorkloadIdentity>;
    gateway: InstanceType<typeof BedrockAgentCoreGateway>;
    gatewayTarget: InstanceType<typeof GatewayTarget>;
};
/**
 * A Bedrock AgentCore agent as one CloudFormation-serializable bundle — the
 * composite/base path from #882: `Runtime` + `Memory` +
 * `Gateway`/`GatewayTarget` + `WorkloadIdentity` + IAM, deployable with
 * `cfn-deploy` + `wait-for-stack` and no bespoke verb.
 *
 * `WorkloadIdentityDetails` on both `Runtime` and `BedrockAgentCoreGateway`
 * is CFN `readOnly` — AWS provisions a workload identity per resource
 * automatically, and neither accepts one as an input. The `WorkloadIdentity`
 * resource this composite creates is therefore standalone (not cross-wired
 * to `runtime`/`gateway`), included because #882 calls for it — it exists
 * for workflows (e.g. a future credential-provider capability) that need an
 * explicit workload identity of their own.
 *
 * There is no `RuntimeEndpoint` in the bundle by default. AgentCore creates a
 * managed `DEFAULT` endpoint with every Runtime and repoints it at each new
 * version on its own, so a CloudFormation `DEFAULT` endpoint is redundant. It
 * is also the race that sank a live deploy (#978): the Runtime resource's
 * `CREATE_COMPLETE` fires while AgentCore is still turning the artifact into
 * a READY agent version, and the endpoint's CREATE then fails with "Agent
 * version 1 must be in READY status". Invoking the Runtime with no qualifier
 * hits the managed DEFAULT endpoint; {@link agentCoreDefaultEndpointArn}
 * builds its ARN from the Runtime's. `endpointName` adds an explicit
 * non-DEFAULT endpoint for the `agentcore-deploy` version-promotion flow,
 * which is deferred (GA-gated, #882) — this composite only wires the
 * CloudFormation shape it would eventually apply against.
 */
export declare const AgentCoreAgent: import("@intentius/chant").CompositeDefinition<AgentCoreAgentProps, AgentCoreAgentResult>;
//# sourceMappingURL=agentcore-agent.d.ts.map