import { type Result } from "@fjall/generator";
import type { AwsProvider } from "../../aws/AwsProvider.js";
/**
 * A repository in an ECR private registry under `amazonaws.com`, which
 * covers the commercial and GovCloud partitions: its account, its Region and
 * its whole repository name. China's `amazonaws.com.cn` hosts, FIPS hosts and
 * dual-stack hosts do not match; the partition fix is FJL-123's.
 */
export declare const ECR_URI_PATTERN: RegExp;
/**
 * Split an image URI of shape `<repo>:<tag>` or `<repo>@sha256:<digest>` from
 * its tag/digest. Prefers `@` over `:` when both appear (digest pinning), so a
 * second-pass parse of a previously digest-pinned image returns the bare repo
 * URI rather than `<repo>@sha256` truncated by the colon in the digest hash.
 */
export declare function stripTagOrDigest(imageUri: string): string;
/**
 * Whether a digest lookup failed on ECR's answer that the repository holds no
 * image under the tag (`BatchGetImage`'s `ImageNotFound`), which a retry of
 * the lookup is given again. Read from the failure code ECR answered, never
 * from message text: ECR's other failure codes, a lookup ECR did not answer
 * and an answer with no digest are not this.
 */
export declare function isImageNotFound(error: Error): boolean;
/**
 * Inspect ECR images by tag to obtain the immutable sha256 digest.
 *
 * Used by the code-only deploy orchestrator to register task definitions
 * pinned to `<repo>@sha256:<digest>` rather than `<repo>:<tag>`. Digest
 * pinning defeats tag mutation: a subsequent CDK redeploy on the same
 * commit will not silently flip running services to an older image,
 * because the registered task definition references the immutable digest
 * captured at code-only deploy time. (Plan AC4.)
 */
export declare class EcrImageInspectorService {
    private readonly awsProvider;
    constructor(awsProvider: AwsProvider);
    /**
     * Look up the sha256 digest for an `(imageUri, imageTag)` pair.
     *
     * Returns `success(undefined)` when the repository URI is not an ECR
     * URI — the caller should fall back to tag pinning in that case (e.g.
     * third-party registries). Returns a failure when the ECR call itself
     * errors, when ECR refuses the tag (an `AwsError` carrying ECR's failure
     * code when it answers one failure, as it does for the one tag asked about,
     * which `isImageNotFound` reads), or when it returns no digest. Not masked:
     * each caller masks at its sink.
     */
    getImageDigest(imageUri: string, imageTag: string, abortSignal?: AbortSignal): Promise<Result<string | undefined, Error>>;
    /**
     * Reverse lookup: the tags attached to an image digest. Needed by the
     * restart operation — after a digest-pinned rollback the live container
     * image reference carries no tag, but the restart Release's artefacts must
     * record one for later `serviceImageTags` rollbacks to consume.
     *
     * Returns `success(undefined)` for non-ECR URIs (caller degrades),
     * `success([])` when the image exists but is untagged.
     */
    getImageTagsByDigest(imageUri: string, imageDigest: string, abortSignal?: AbortSignal): Promise<Result<string[] | undefined, Error>>;
}