/**
 * Cloud provider connection and resource types (AWS, GCP, Azure, MongoDB Atlas, Neo4j Aura).
 */
/** Supported cloud providers */
export type CloudProvider = 'aws' | 'gcp' | 'azure' | 'mongodb_atlas' | 'neo4j_aura';
/** How the cloud account is linked to Ductape */
export type CloudAuthMode = 'iam_role' | 'oauth' | 'service_principal' | 'workload_identity' | 'api_key';
/** Connection lifecycle status */
export type CloudConnectionStatus = 'pending' | 'active' | 'error' | 'revoked';
/** Scopes gate which resource types can be listed/imported */
export type CloudConnectionScope = 'storage' | 'broker' | 'database' | 'graph' | 'vector' | 'cache' | 'notifications';
/** Workspace cloud connection record */
export interface ICloudConnection {
    id: string;
    workspace_id: string;
    provider: CloudProvider;
    display_name: string;
    tag: string;
    account_identifier: string;
    auth_mode: CloudAuthMode;
    status: CloudConnectionStatus;
    scopes: CloudConnectionScope[];
    metadata?: Record<string, unknown>;
    created_by?: string;
    created_at?: string;
    updated_at?: string;
}
export interface ICreateCloudConnectionInput {
    provider: CloudProvider;
    name: string;
    scopes?: CloudConnectionScope[];
    auth_mode?: CloudAuthMode;
}
/** Returned when a connection requires customer-side setup (e.g. IAM trust policy) */
export interface ICloudConnectionSetup {
    connection: ICloudConnection;
    external_id?: string;
    trust_policy?: Record<string, unknown> | string;
    setup_instructions?: string;
    setup_url?: string;
}
export interface IUpdateCloudConnectionInput {
    display_name?: string;
    description?: string;
    scopes?: CloudConnectionScope[];
}
export type AwsSecurityGroupResourceType = 'rds' | 'neptune';
/** Customer-managed VPC security group registered on an AWS cloud connection */
export interface IAwsRegisteredSecurityGroup {
    tag: string;
    groupId: string;
    resourceTypes: AwsSecurityGroupResourceType[];
    region?: string;
    description?: string;
}
export interface IUpdateCloudSecurityGroupsInput {
    security_groups: IAwsRegisteredSecurityGroup[];
}
export type CloudNetworkingMode = 'customer' | 'managed' | 'vpc_connector';
export interface IVpcConnectorSecurityGroupRef {
    groupId: string;
    region: string;
    vpcId?: string;
    name?: string;
}
export interface IVpcConnectorConfig {
    vpc_id: string;
    subnet_ids: string[];
    region: string;
    connector_security_group: IVpcConnectorSecurityGroupRef;
    data_security_group: IVpcConnectorSecurityGroupRef;
    app_security_group_ids?: string[];
    agent_status?: 'pending' | 'connected' | 'disconnected';
    agent_last_seen_at?: string;
    enrollment_token?: string;
}
export interface IUpdateCloudVpcConnectorInput {
    vpc_id: string;
    subnet_ids: string[];
    region?: string;
    app_security_group_ids?: string[];
    rotate_enrollment_token?: boolean;
}
export interface ICloudVpcConnectorStatus {
    connection_tag: string;
    agent_status: 'pending' | 'connected' | 'disconnected';
    agent_last_seen_at?: string;
    vpc_id: string;
    region: string;
    subnet_ids: string[];
    connector_security_group: IVpcConnectorSecurityGroupRef;
    data_security_group: IVpcConnectorSecurityGroupRef;
}
export interface IAllowedSourceCidr {
    cidr: string;
    label?: string;
    source?: 'custom' | 'ductape_proxy' | 'detected';
}
export interface IUpdateCloudManagedNetworkingInput {
    mode?: CloudNetworkingMode;
    allowed_sources?: IAllowedSourceCidr[];
    include_ductape_proxy?: boolean;
    ductape_proxy_host?: string;
    ductape_proxy_addresses?: string[];
    region?: string;
}
export interface IResolveCloudHostResult {
    host: string;
    addresses: string[];
}
export interface ICompleteCloudConnectionInput {
    /** AWS cross-account role */
    role_arn?: string;
    /** GCP project */
    project_id?: string;
    /** GCP service account JSON or email (optional when using WIF) */
    service_account_email?: string;
    service_account_json?: string | Record<string, unknown>;
    /** Azure service principal */
    tenant_id?: string;
    subscription_id?: string;
    client_id?: string;
    client_secret?: string;
    default_location?: string;
    /** Azure legacy blob-only (optional when using service principal) */
    connection_string?: string;
    /** MongoDB Atlas */
    atlas_public_key?: string;
    atlas_private_key?: string;
    /** Neo4j Aura */
    aura_client_id?: string;
    aura_client_secret?: string;
    aura_instance_id?: string;
}
export interface IValidateCloudConnectionResult {
    valid: boolean;
    status: CloudConnectionStatus;
    message?: string;
    tested_at?: string;
}
/** Cloud resource kinds exposed by the connector */
export type CloudResourceService = 's3' | 'sqs' | 'sns' | 'gcs' | 'pubsub' | 'firebase' | 'blob' | 'servicebus' | 'rds' | 'postgresql' | 'cloudsql' | 'dynamodb' | 'keyspaces' | 'neptune' | 'cosmos-gremlin' | 'opensearch' | 'azure-search' | 'spanner-graph' | 'vertex-vector-search' | 'pinecone' | 'atlas-cluster' | 'aura-instance';
export interface ICloudResource {
    id: string;
    name: string;
    arn?: string;
    region?: string;
    service: CloudResourceService;
    provider: CloudProvider;
    metadata?: Record<string, unknown>;
}
export interface IListCloudResourcesInput {
    /** Workspace cloud connection tag */
    cloud: string;
    service: CloudResourceService;
    region?: string;
    prefix?: string;
    page?: number;
    limit?: number;
}
export interface IListCloudResourcesResult {
    resources: ICloudResource[];
    total?: number;
    page?: number;
    limit?: number;
    hasMore?: boolean;
}
/** Target Ductape component when importing or provisioning */
export type CloudComponentType = 'storage' | 'messageBrokers' | 'databases' | 'graphs' | 'vectors' | 'caches';
export interface IImportCloudResourceInput {
    /** Workspace cloud connection tag */
    cloud: string;
    service: CloudResourceService;
    resource: string;
    type: CloudComponentType;
    product: string;
    component: string;
    env: string;
    /** Region hint for resource lookup — important for region-scoped services like Neptune */
    region?: string;
    /** Required when importing existing RDS / Cloud SQL / PostgreSQL — AWS does not return passwords */
    masterPassword?: string;
    /** MongoDB Atlas only: database name to inject into the connection string */
    dbName?: string;
}
/** Service-specific provision fields (top-level on provision input, not nested under params). */
export interface ICloudProvisionFields {
    /**
     * Tier name from the Ductape cloud tiers catalogue (see `cloud.tiers.list()`).
     * Maps directly to the provider's instance class or SKU — e.g. `db.t3.micro` (AWS RDS),
     * `db-f1-micro` (GCP Cloud SQL), `Standard_B1ms` (Azure), `M0` (MongoDB Atlas).
     * Takes precedence over `instanceClass` / `sku`.
     */
    tier?: string;
    /** Provider instance class when not using a catalogue tier name (e.g. `db.t3.medium`). */
    instanceClass?: string;
    securityGroups?: string[];
    region?: string;
    location?: string;
    publiclyAccessible?: boolean;
    instance?: string;
    serverName?: string;
    clusterIdentifier?: string;
    engine?: string;
    dbName?: string;
    databaseName?: string;
    bucketName?: string;
    containerName?: string;
    name?: string;
    queueName?: string;
    topicName?: string;
    namespaceName?: string;
    domainName?: string;
    indexName?: string;
    serviceName?: string;
    accountName?: string;
    dbSubnetGroupName?: string;
}
export interface IProvisionCloudResourceInput extends ICloudProvisionFields {
    /** Workspace cloud connection tag */
    cloud: string;
    service: CloudResourceService;
    template?: string;
    type: CloudComponentType;
    product: string;
    component: string;
    env: string;
    /** When false, start cloud create and return immediately (databases only). Default true. */
    waitForReady?: boolean;
    /** @deprecated Put provision fields on the input root instead */
    params?: Record<string, unknown>;
}
/** Partial product component returned by the connector for builder persistence */
export interface ICloudComponentDraft {
    type: CloudComponentType;
    tag: string;
    name?: string;
    description?: string;
    draft: Record<string, unknown>;
}
export interface IImportCloudResourceResult {
    resource: ICloudResource;
    componentDraft: ICloudComponentDraft;
}
export interface IProvisionCloudResourceResult extends IImportCloudResourceResult {
    provisioned: boolean;
    /** True when provision was accepted but cloud resource is not ready yet */
    pending?: boolean;
}
/** Runtime short-lived credentials (proxy / connector broker) */
export interface ICloudRuntimeCredentialsInput {
    /** Workspace cloud connection tag */
    cloud?: string;
    /** @deprecated Legacy persisted configs only */
    connectionId?: string;
    product: string;
    component: string;
    env: string;
    purpose?: 'runtime' | 'validate';
}
export interface ICloudRuntimeCredentialsNetworking {
    mode?: CloudNetworkingMode;
    vpc_connector?: {
        cloud?: string;
        agent_status?: 'pending' | 'connected' | 'disconnected';
    };
}
export interface ICloudRuntimeCredentials {
    provider: CloudProvider;
    expiresAt: string;
    credentials: Record<string, unknown>;
    networking?: ICloudRuntimeCredentialsNetworking;
}
/** Optional fields on storage/broker configs when linked via cloud connection */
export type ComponentCloudAuthMode = 'manual' | 'cloud_connection';
export interface ICloudLinkedComponentFields {
    authMode?: ComponentCloudAuthMode;
    /** User-friendly cloud connection tag (preferred over cloudConnectionId) */
    cloud?: string;
    /** @deprecated Use cloud tag instead Host configs */
    cloudConnectionId?: string;
    roleArn?: string;
}