import type { V1Job } from "@kubernetes/client-node";
export type BuildDumpJobInput = {
    dumpId: string;
    tenantNs: string;
    image: string;
    bucket: string;
    s3Endpoint: string;
    /**
     * S3 credentials, passed inline as plain env values rather than via
     * secretKeyRef. Rationale: a per-namespace `env-dumps-s3-credentials`
     * Secret would require either a chart change (per-tenant ExternalSecret
     * gating) or RBAC `secrets: create` for the subgraph SA. The keys are
     * visible to anyone with `kubectl get pod -o yaml` in the tenant ns,
     * but those callers can already read the colocated `<ns>-pg-app` DB
     * password Secret directly, so the disclosure surface is the same.
     * Job pods are also short-lived (1h hard limit, 10min TTL after
     * completion).
     */
    s3AccessKey: string;
    s3SecretKey: string;
};
/**
 * Builds the one-shot Job manifest for an on-demand pg_dump.
 *
 * - Runs against the tenant's PgBouncer pooler, not the primary, so
 *   `pg_dump` shares the same connection path the app uses.
 * - `backoffLimit: 0` — failure surfaces to the user as FAILED; "Retry"
 *   creates a new dump rather than re-running the same Job.
 * - `activeDeadlineSeconds: 3600` — hard 1h ceiling; envs with massive
 *   DBs would be a separate feature anyway.
 * - DB credentials come from the chart-rendered `<ns>-pg-app` secret.
 *   S3 credentials come from a per-tenant `env-dumps-s3-credentials`
 *   ExternalSecret (one bucket prefix scope per tenant).
 */
export declare function buildDumpJob(input: BuildDumpJobInput): V1Job;
//# sourceMappingURL=job-spec.d.ts.map