import type { BaseProvider, SecretInjectionStrategy } from '@kubricate/core';
import type { BaseStack } from '../stack/BaseStack.js';
import type { FallbackIfNever } from '../types.js';
/**
 * Extract only the strategy types allowed for this provider
 */
type ExtractAllowedKinds<Kinds extends SecretInjectionStrategy['kind'] = SecretInjectionStrategy['kind']> = Extract<SecretInjectionStrategy, {
    kind: Kinds;
}>;
/**
 * SecretInjectionBuilder provides a fluent API to define how a secret should be injected into a resource.
 *
 * @example
 *   injector.secrets('MY_SECRET')
 *     .inject({ kind: 'env', containerIndex: 0 })
 *     .intoResource('my-deployment'); // Optional
 */
export declare class SecretInjectionBuilder<Kinds extends SecretInjectionStrategy['kind'] = SecretInjectionStrategy['kind']> {
    private readonly stack;
    private readonly secretName;
    private readonly provider;
    private readonly ctx;
    private strategy?;
    private resourceIdOverride?;
    /**
     * The injected name override (used when `.forName(...)` is called).
     *
     * This will appear in the final manifest, such as an env var name or volume mount name.
     * If not provided, the original secretName will be used.
     */
    private targetName?;
    constructor(stack: BaseStack, secretName: string, provider: BaseProvider, ctx: {
        defaultResourceId?: string;
        secretManagerId: number;
        providerId: string;
    });
    /**
     * Override the name to be injected into the target manifest.
     *
     * This is useful when the name used inside the resource (e.g., env var name)
     * should differ from the registered secret name in the SecretManager.
     *
     * If not provided, the original secret name will be used.
     *
     * Example:
     *   .secrets('MY_SECRET').forName('API_KEY').inject({ kind: 'env' });
     *
     * Output:
     *   - name: API_KEY
     *     valueFrom:
     *       secretKeyRef:
     *         name: secret-application
     *         key: MY_SECRET
     *
     * @param name The name to use in the final manifest (e.g., environment variable name).
     */
    forName(name: string): this;
    /**
     * Define how this secret should be injected into the Kubernetes resource.
     *
     * 👉 You can call `.inject(strategy)` with a specific strategy, or use `.inject()` with no arguments
     * if the provider only supports **one** strategy kind (e.g. `'env'`).
     *
     * This method is **type-safe** and enforces allowed `kind` values per provider via TypeScript inference.
     *
     * @example
     *   // Explicit strategy:
     *   injector.secrets('APP_SECRET').inject('env', { containerIndex: 0 });
     *
     *   // Implicit (default strategy):
     *   injector.secrets('APP_SECRET').inject(); // uses first provider-supported default
     */
    inject(): this;
    inject(kind?: ExtractAllowedKinds<Kinds>['kind'], strategyOptions?: Omit<FallbackIfNever<ExtractAllowedKinds<Kinds>, SecretInjectionStrategy>, 'kind'>): this;
    /**
     * Resolves a default injection strategy based on the `kind` supported by the provider.
     * This allows `.inject()` to be used without arguments when the provider supports exactly one kind.
     *
     * Each kind has its own defaults:
     * - `env` → `{ kind: 'env', containerIndex: 0 }`
     * - `imagePullSecret` → `{ kind: 'imagePullSecret' }`
     * - `annotation` → `{ kind: 'annotation' }`
     *
     * If the kind is unsupported for defaulting, an error is thrown.
     */
    resolveDefaultStrategy(kind: SecretInjectionStrategy['kind']): SecretInjectionStrategy;
    /**
     * Explicitly define the resource ID that defined in the composer e.g. 'my-deployment', 'my-job' to inject into.
     */
    intoResource(resourceId: string): this;
    /**
     * Resolve and register the final injection into the stack.
     * Should be called by SecretsInjectionContext after the injection chain ends.
     */
    resolveInjection(): void;
    /**
     * Resolve which resource ID to inject into.
     * Priority: .intoResource(...) > setDefaultResourceId(...) > infer from provider.targetKind
     */
    private resolveResourceId;
}
export {};
//# sourceMappingURL=SecretInjectionBuilder.d.ts.map