/**
 * MicrovmApp — composite-first delivery of AWS Lambda MicroVM support (#879).
 *
 * Emits `AWS::Lambda::MicrovmImage` (a preview CFN resource type — see the
 * issue's "Preview-API gate") plus the least-privilege build/execution IAM
 * roles the upstream `ran-isenberg/lambda-microvm-cdk-python` construct
 * creates, and — only when build-time VPC egress is requested — an
 * `AWS::Lambda::NetworkConnector`, its deny-all-egress security group, and its
 * ENI operator role.
 *
 * Base path only (#879 scope): `chant build` serializes this composite to a
 * CloudFormation template; `cfn-deploy` + `wait-for-stack` deploy it and wait
 * for the image snapshot to build, with no bespoke verb. The
 * `microvm-image-build` capability (build-once / promote-by-ARN) is deferred
 * — see the issue's "Settled decisions".
 *
 * The IAM shapes below mirror `lambda_microvm_cdk._impl.security` (build role
 * scoped to the exact S3 code-artifact object + the image's own log group;
 * execution role scoped to runtime logs only; connector operator role scoped
 * to the AWS-documented `ec2:CreateNetworkInterface`/`CreateTags` grant), and
 * the deny-all security group reproduces `aws-cdk-lib`'s own
 * `MATCH_NO_TRAFFIC` placeholder rule (`aws-ec2/lib/security-group.ts`) —
 * spot-checked against both upstream sources so the shapes match what the
 * MicroVM service actually expects, not a guess.
 */
import { MicrovmImage, MicrovmImage_Hooks, NetworkConnector, Role, SecurityGroup } from "../generated/index.js";
/**
 * The Lambda MicroVMs service's real limits, verified against the upstream
 * `ran-isenberg/lambda-microvm-cdk-python` construct and the AWS docs.
 *
 * Exported because a consumer driving the same service through a different
 * control plane needs the same numbers, and copying them is how two sources of
 * truth start (#1374). The CFN schema types most of these as open ints and
 * strings, so nothing but this object knows them.
 */
export declare const MICROVM_LIMITS: {
    /** Documented baseline memory tiers (MiB). The schema says int; the service accepts five values. vCPU auto-scales with the tier. */
    readonly memoryMiB: readonly [512, 1024, 2048, 4096, 8192];
    readonly namePattern: RegExp;
    readonly maxNameLength: 64;
    /** Set by the service on every MicroVM; supplying it is rejected. */
    readonly reservedEnvironmentKeys: readonly ["AWS_REGION"];
    readonly maxEnvironmentVariables: 50;
    readonly maxEgressConnectors: 10;
    readonly connectorSubnets: {
        readonly min: 1;
        readonly max: 16;
    };
};
/** One of the five memory tiers {@link MICROVM_LIMITS} names. */
export type MicrovmMemoryMiB = (typeof MICROVM_LIMITS.memoryMiB)[number];
export interface MicrovmAppBuildConnectorProps {
    /** VPC the connector's ENIs attach to. */
    vpcId: string;
    /** 1-16 subnet ids, all in `vpcId` — where Lambda provisions the connector's ENIs. */
    subnetIds: string[];
    /** `"IPv4"` (default) or `"DualStack"`. */
    networkProtocol?: "IPv4" | "DualStack";
}
export interface MicrovmAppProps {
    /** Unique image name (`^[a-zA-Z0-9-_]+$`, ≤64 chars). Create-only — changing it forces replacement. */
    name: string;
    /** Human-readable description. CFN requires the property; `""` is valid. */
    description?: string;
    /**
     * The `CodeArtifact.Uri` value CloudFormation wants — e.g. the `uri` a
     * `publish-artifact` step produced (`"@Publish.uri"`, wired in by the
     * driver). Kept distinct from {@link codeArtifactObjectArn}: this is the
     * value the MicroVM service resolves the artifact from, while that one is
     * the resource ARN the build role's IAM grant is scoped to — the two only
     * coincide by convention, not by type.
     */
    codeArtifactUri: string;
    /**
     * Exact S3 object ARN of the code artifact, for the build role's
     * `s3:GetObject` grant. Scoped to the precise object (never `bucket/*`),
     * matching the upstream construct's `artifact_object_arn`. Pass the
     * caller-resolved ARN rather than have this composite parse one out of an
     * arbitrary URI — the same "wired reference, already resolved by the
     * driver" convention `cfn-deploy`'s `imageRef` uses.
     */
    codeArtifactObjectArn: string;
    /** AWS-managed base image alias (e.g. `"al2023-1"`) or a full base-image ARN. */
    baseImage: string;
    /**
     * Base image version to pin. Default: `"0"` — the fallback the upstream
     * construct itself uses when a synth-time boto3 lookup isn't available.
     * Chant's synth is deterministic/offline, so this composite never performs
     * a live lookup; pin this explicitly for a specific managed version.
     */
    baseImageVersion?: string;
    /** Baseline memory tier in MiB — one of the five documented tiers; vCPU auto-scales with it. Default: `2048`. */
    memoryMiB?: MicrovmMemoryMiB;
    /** Env vars baked into the image at build time (max 50) — snapshotted and shared by every VM booted from this image. Never put secrets here. */
    environment?: Record<string, string>;
    /** Opt into `"ALL"` additional OS capabilities — a documented privilege escalation. Default: none (least privilege). */
    additionalOsCapabilities?: "ALL"[];
    /** Disable CloudWatch build/runtime logging entirely. Default: `false` (logging enabled, pinned to `/aws/lambda/microvms/<name>`). */
    disableLogging?: boolean;
    /** Lifecycle hooks — all default to disabled (traffic flows immediately). */
    hooks?: ConstructorParameters<typeof MicrovmImage_Hooks>[0];
    /**
     * Build-time egress: attach a `NetworkConnector` (+ its deny-all-egress
     * security group + least-privilege ENI operator role) so the image build
     * can reach a VPC (private mirrors, an internal registry). Omit for the
     * default public-internet build egress. The connector's security-group
     * rules ARE its egress policy — deny-all by default; open it via
     * `defaults.connectorSecurityGroup`.
     */
    buildConnector?: MicrovmAppBuildConnectorProps;
    /** Extra egress connector ARNs to bake in alongside the one this composite creates (e.g. an AWS-managed `INTERNET_EGRESS` alias, or a pre-existing shared connector). Max 10 total. */
    additionalEgressConnectors?: string[];
    defaults?: {
        buildRole?: Partial<ConstructorParameters<typeof Role>[0]>;
        executionRole?: Partial<ConstructorParameters<typeof Role>[0]>;
        connectorOperatorRole?: Partial<ConstructorParameters<typeof Role>[0]>;
        connectorSecurityGroup?: Partial<ConstructorParameters<typeof SecurityGroup>[0]>;
        connector?: Partial<ConstructorParameters<typeof NetworkConnector>[0]>;
        image?: Partial<ConstructorParameters<typeof MicrovmImage>[0]>;
    };
}
export type MicrovmAppResult = {
    /** Least-privilege role the MicroVM service assumes to build the image — `s3:GetObject` on the exact code-artifact object, `logs:*` on the image's own log group. */
    buildRole: InstanceType<typeof Role>;
    /** Least-privilege role assumed by the running MicroVM — runtime-logs only; add workload permissions (e.g. Bedrock) on top. */
    executionRole: InstanceType<typeof Role>;
    /** The `AWS::Lambda::MicrovmImage` resource. */
    image: InstanceType<typeof MicrovmImage>;
    /** The build-egress connector's deny-all security group (only when `buildConnector` is set). */
    connectorSecurityGroup?: InstanceType<typeof SecurityGroup>;
    /** The connector's least-privilege ENI operator role (only when `buildConnector` is set). */
    connectorOperatorRole?: InstanceType<typeof Role>;
    /** The `AWS::Lambda::NetworkConnector` resource (only when `buildConnector` is set). */
    connector?: InstanceType<typeof NetworkConnector>;
};
export declare const MicrovmApp: import("@intentius/chant").CompositeDefinition<MicrovmAppProps, MicrovmAppResult>;
//# sourceMappingURL=microvm-app.d.ts.map