import type { ParsedDomainProps } from "@fjall/generator";
import { type CertificateValidationReadParams, type CertificateValidationRecord } from "./certificateValidation.js";
/**
 * Whether a domain's certificates are validated by records Fjall cannot
 * write. An `external-records` domain has no hosted zone, so ACM's
 * validation CNAMEs must be created by hand at the external DNS provider;
 * every other registrar validates through a Route53 zone the stack owns.
 */
export declare function certificatesAwaitManualValidation(props: ParsedDomainProps): boolean;
export interface CertificateValidationWatchParams extends CertificateValidationReadParams {
    /** The domain being deployed; every announcement names it. */
    readonly domainName: string;
    /** Receives each announcement. Messages are pre-masked. */
    readonly onWarning: (message: string) => void;
    /** Delay between reads. Tests shorten it. */
    readonly pollIntervalMs?: number;
}
export type CertificateValidationWatchOutcome = 
/** No certificate was seen in the stack while the operation ran. */
{
    readonly kind: "not-observed";
}
/** Certificates were seen; `outstanding` is the latest read of what ACM awaits. */
 | {
    readonly kind: "observed";
    readonly outstanding: readonly CertificateValidationRecord[];
}
/** Nothing could be read. `reason` is pre-masked. */
 | {
    readonly kind: "unavailable";
    readonly reason: string;
};
export interface CertificateValidationWatched<R> {
    readonly result: R;
    readonly watch: CertificateValidationWatchOutcome;
}
/**
 * Run a domain deploy while reading, alongside it, the validation records
 * ACM chooses for the stack's certificates.
 *
 * CloudFormation creates an ACM certificate and then waits, without
 * reporting why, until its validation CNAMEs resolve publicly. For an
 * `external-records` domain nobody but the operator can create them, and the
 * records exist only once ACM has been asked for the certificate. So the
 * stack is read immediately and then every 15 seconds while `operation`
 * runs: the first time a record is seen it is announced through `onWarning`,
 * once per distinct record however many certificates share it. An unusable
 * certificate, a denied read and each distinct transient read failure are
 * announced once too; a denied read stops the polling, since a retry cannot
 * cure it.
 *
 * When `operation` fails (a CDK timeout leaves CloudFormation still waiting,
 * and a re-run against that stack fails within seconds) the stack is read
 * once more after it settles, so the records are announced even when no poll
 * finished in time. The outcome carries what ACM was last seen waiting for.
 */
export declare function withCertificateValidationWatch<R extends {
    readonly success: boolean;
}>(params: CertificateValidationWatchParams, operation: () => Promise<R>): Promise<CertificateValidationWatched<R>>;
/**
 * A failed domain deploy's message with what ACM was waiting for appended,
 * or the message alone when there is nothing to add. `cure` is the host's
 * next step, appended only when records were outstanding (an unavailable
 * reason names its own cure). Pre-masked: the returned message is masked
 * here on both paths, whatever the caller passed.
 */
export declare function appendCertificateValidationOutcome(message: string, outcome: CertificateValidationWatchOutcome, cure: string): string;