/**
 * SSM port-forwarding tunnel used by the `db_query` / `get_db_schemas` MCP tools
 * when the selected DB SSH host is of connectionType `'ssm'` (see
 * `SshCredentials.connectionType`). Instead of a plain SSH channel
 * (`db-tunnel.ts`), this opens a local port forward through
 * `aws ssm start-session ... AWS-StartPortForwardingSessionToRemoteHost`
 * (session-manager-plugin), so mysql2/pg can connect to `127.0.0.1:<localPort>`
 * and have traffic forwarded to the real database host via SSM.
 *
 * Returns the same `{ host, port, close }` (`DbTunnel`) interface as
 * `openSshTunnel`, so `executeQueryWithTunnel` treats both transports
 * uniformly.
 *
 * Fallback禁止 (see CLAUDE.md): missing instanceId/region/awsCredentials or a
 * subprocess that never opens the port is a hard error — never a silent direct
 * connection.
 *
 * Lifecycle: the caller (`executeQueryWithTunnel`) opens one tunnel per query
 * and always `close()`s it in a `finally`, so the session-manager-plugin
 * subprocess does not leak across queries even though the agent process is
 * long-lived.
 *
 * SECURITY: `awsCredentials` (access key / secret / session token) are passed to
 * the subprocess only via env and must never be logged. stdin and stdout (the
 * forwarded data) are ignored so no forwarded payload can reach the agent logs
 * and a full stdout pipe can never block the long-running session; only stderr
 * is captured (size-bounded) so a failed handshake's reason — plugin missing,
 * TargetNotConnected, AccessDenied — is surfaced in the thrown error instead of
 * being silently discarded. AWS credentials travel via env, not stderr, so the
 * captured tail does not contain them.
 */
import type { SsmAwsCredentials } from '../../types/project';
import type { DbTunnel, TunnelTarget } from './db-tunnel';
export interface SsmTunnelParams {
    instanceId: string;
    region: string;
    awsCredentials: SsmAwsCredentials;
    target: TunnelTarget;
    /** Total budget for the local forwarded port to start accepting connections. */
    timeoutMs?: number;
}
/**
 * Open an SSM local port forward to `target` on `instanceId`. Returns the local
 * endpoint to connect to and a `close()` that tears down the subprocess.
 */
export declare function openSsmTunnel(params: SsmTunnelParams): Promise<DbTunnel>;
//# sourceMappingURL=db-ssm-tunnel.d.ts.map