import type { AdditionalDiagnosticContext } from '../../actions/diagnose';
import type { SDK } from '../aws-auth/sdk';
import type { IoHelper } from '../io/private/io-helper';
import type { ResourceError } from '../stack-events/resource-errors';
/**
 * A CloudTrail error event correlated to a stack resource.
 */
export interface CorrelatedCloudTrailError {
    /**
     * The stack of the resource the event was attributed to.
     */
    readonly stackArn: string;
    /**
     * Logical ID of the stack resource the event was attributed to.
     */
    readonly logicalId: string;
    /**
     * Human-readable description of the attributed resource.
     */
    readonly description: string;
    /**
     * The formatted, user-facing description of the event.
     */
    readonly message: string;
    /**
     * Time the API call was made (not when the event was delivered).
     */
    readonly eventTime?: Date;
}
/**
 * Result of a CloudTrail investigation for a stack.
 */
export interface CloudTrailInvestigation {
    /**
     * Correlated error events, deduplicated, earliest-first, capped at {@link MAX_EVENTS_SHOWN}.
     */
    readonly errors: CorrelatedCloudTrailError[];
    /**
     * Extra notes about the scan itself (truncation, overflow, delivery-latency hint).
     */
    readonly notes: string[];
}
/**
 * Investigate a failed stack via CloudTrail: sweep the failure window for errored
 * control-plane calls made by the stack's own principals, and return them attributed to the
 * resource they belong to.
 *
 * Returns `undefined` when the investigation could not run (no failure timestamps to bound
 * the window, or the lookup itself failed). Lookup failures are reported through the IoHost
 * as warnings — a broken lookup is a tooling problem, not a diagnosis result.
 */
export declare function investigateStackViaCloudTrail(sdk: SDK, errors: readonly ResourceError[], ioHelper: IoHelper): Promise<CloudTrailInvestigation | undefined>;
/**
 * A CloudTrail context attributed to a specific stack resource.
 */
export interface AttributedCloudTrailContext {
    /**
     * The stack of the resource the context belongs to.
     */
    readonly stackArn: string;
    /**
     * Logical ID of the resource the context belongs to.
     */
    readonly logicalId: string;
    /**
     * Human-readable description of the resource, for labeling the context when it cannot be
     * attached to that resource's own problem entry.
     */
    readonly description: string;
    /**
     * The diagnostic context to attach.
     */
    readonly context: AdditionalDiagnosticContext;
}
/**
 * Group a CloudTrail investigation's findings into per-resource diagnostic contexts.
 *
 * Grouping is per (stack, logical ID) — logical IDs alone are not unique across nested
 * stacks. The caller attaches each context to the matching problem, or presents it with its
 * `description` label when the resource is not itself among the problems.
 */
export declare function attributedCloudTrailContexts(investigation: CloudTrailInvestigation): AttributedCloudTrailContext[];
//# sourceMappingURL=cloudtrail-investigation.d.ts.map