/**
 * Command matrix — versioned command cells keyed by
 * (siem × forwarder × install_method).
 *
 * Commands are exactly where hallucination is unaffordable, so cells
 * are static data, tested per cell, and the agent never composes
 * them. Missing context values are NOT invented: they render as
 * explicit `<fill-me>` placeholders the user must substitute, and the
 * report's apply block keeps them visibly marked.
 *
 * v1 ships two cells (design doc):
 *   cloudwatch × fluentd × k8s
 *   splunk    × hec     × k8s
 * The engine-side apply (caps.csv ConfigMap + rollout restart) is
 * SIEM-agnostic; what differs per SIEM is the retrieval/query key
 * notes and diagnostics. `host` install cells are reserved for a
 * later version — lookup returns null and the renderer says so
 * honestly rather than guessing service paths.
 */
export type InstallMethod = 'k8s' | 'host';
/**
 * Forwarder key space: discovery's ForwarderKind spellings, plus
 * 'hec' (a Splunk delivery path, not a detected forwarder). An alias
 * map normalizes the other enums' spellings — no fourth vocabulary.
 */
export type MatrixForwarder = 'fluentd' | 'fluent-bit' | 'filebeat' | 'logstash' | 'otel-collector' | 'vector' | 'hec';
export declare function normalizeForwarder(raw: string | undefined): MatrixForwarder | null;
export interface CmdCtx {
    /** k8s namespace the engine forwarder runs in. */
    namespace?: string;
    /** Forwarder workload name (daemonset/deployment). */
    workload?: string;
    /** Local caps file name written next to the report. */
    capsFileName: string;
}
export interface CommandCell {
    applyCaps(ctx: CmdCtx): string[];
    undoCaps(ctx: CmdCtx): string[];
    /** DNS diagnostic for operational actions whose cluster tokens
     * indicate resolution failures. */
    checkDns?(ctx: CmdCtx): string[];
}
/** Visible fill-me marker — tested to never be silently dropped. */
export declare const FILL_ME_NS = "<namespace>";
export declare const FILL_ME_WORKLOAD = "<forwarder-workload>";
export declare function lookupCommandCell(siem: string | null, forwarder: string | null, install: InstallMethod): CommandCell | null;
/** Exported for the per-cell test sweep. */
export declare const _cellKeys: () => string[];