import type { AwsProvider } from "../../aws/AwsProvider.js";
import { type Result } from "@fjall/generator";
import { BaseServiceError } from "../../types/errors/ServiceError.js";
/**
 * A Lambda API failure, by the operation that failed.
 *
 * Messages are pre-masked at construction, in this file. A rejected
 * PublishVersion or UpdateFunctionCode is worded around
 * `const errorMessage = maskSensitiveOutput(rawErrorMessage);`, and a
 * rejected GetFunction around `sdkFailureReason(error, abortSignal)`, which
 * names only the per-call budget or is
 * `maskSensitiveOutput(getErrorMessage(error))` in
 * `aws/utils/sdkCallTimeout.ts`. A failed read of an update's completion
 * masks inline, as `maskSensitiveOutput(rawErrorMessage)`, and an update
 * Lambda reports failed as
 * `maskSensitiveOutput(statusReason ?? "no reason reported")`. Around each,
 * and in every other message, there is only fixed text, the function's name,
 * a duration and an HTTP status. Consumers surface `.message` directly. Not
 * covered: `details`, which can hold the SDK's error, Lambda's response or
 * its status reason unmasked.
 */
export declare class LambdaError extends BaseServiceError {
    readonly functionName: string;
    readonly operation: "publish_version" | "update_function_code" | "get_function";
    constructor(message: string, functionName: string, operation: "publish_version" | "update_function_code" | "get_function", details?: unknown);
}
export interface PublishedLambdaVersion {
    functionArn: string;
    version: string;
}
/**
 * What GetFunction says of a function's `$LATEST`. Its `Code.Location`, a
 * presigned URL that downloads the deployment package, is never read.
 */
export interface LambdaFunctionImage {
    /** The image Lambda resolved, by digest: `<repository>@sha256:<hex>`. */
    resolvedImageUri?: string;
    lastUpdateStatus?: string;
    /** Lambda's reason for `lastUpdateStatus`, masked at construction. */
    lastUpdateStatusReason?: string;
    /** The revision an update can be made conditional on (`updateFunctionCode`). */
    revisionId?: string;
}
export interface UpdateFunctionCodeOptions {
    /**
     * Update only while the function is still at this revision. When it has
     * moved on, Lambda refuses the update and the failure's
     * `details.errorName` is `PreconditionFailedException`.
     */
    revisionId?: string;
}
export interface UpdatedLambdaFunctionCode {
    functionArn: string;
    version: string;
    /**
     * Set when the update was accepted but its completion could NOT be
     * verified (the deploy role lacks `lambda:GetFunctionConfiguration`).
     * Absent means the update was polled to `LastUpdateStatus: Successful`.
     */
    unverifiedReason?: string;
}
/**
 * Lambda service using the AwsProvider interface. Constructor-injected
 * provider matches the `EcsService`/`CloudFormationService` pattern.
 */
export declare class LambdaService {
    private aws;
    constructor(aws: AwsProvider);
    private getClient;
    /**
     * Publish a new immutable version of a Lambda function pointing at
     * whatever is currently deployed as `$LATEST`. Used right after a
     * container-image Lambda's `cdk deploy` succeeds — CDK's `.currentVersion`
     * can't be trusted to do this itself when the image reference is a
     * `CfnParameter` (its logical-id hash is computed from synth-time template
     * shape, not the parameter's deploy-time resolved value, so the hash
     * doesn't change between deploys even though the underlying image does).
     */
    publishVersion(functionName: string, abortSignal?: AbortSignal): Promise<Result<PublishedLambdaVersion, LambdaError>>;
    /**
     * Read the image a container-image function's `$LATEST` runs, the state
     * of its last update and its revision.
     *
     * A failure's message is pre-masked at construction, as {@link LambdaError}
     * says, and so is `lastUpdateStatusReason`, by
     * `maskSensitiveOutput(lastUpdateStatusReason)` here.
     */
    getFunctionImage(functionName: string, abortSignal?: AbortSignal): Promise<Result<LambdaFunctionImage, LambdaError>>;
    /**
     * Update a container-image Lambda function's code directly — the Lambda
     * equivalent of ECS's `UpdateService`/`RegisterTaskDefinition` for a
     * code-only deploy, bypassing CloudFormation entirely. Publishes a new
     * version in the same call (`Publish: true`) since we own this API call
     * directly here — unlike the full-deploy path, where CloudFormation
     * performs the code update and `publishVersion` has to run as a separate
     * step afterward.
     */
    updateFunctionCode(functionName: string, imageUri: string, abortSignal?: AbortSignal, options?: UpdateFunctionCodeOptions): Promise<Result<UpdatedLambdaFunctionCode, LambdaError>>;
    /**
     * UpdateFunctionCode is accepted asynchronously: the API returns 200 with
     * `LastUpdateStatus: InProgress`, and a container-image update can still
     * fail afterwards (image optimisation — ImageAccessDenied, InvalidImage,
     * ImageDeleted), leaving the function on its previous code. Poll the
     * configuration until the update lands, mirroring the ECS rollout's
     * `pollDeployment` semantics (same 600s budget). A role missing
     * `lambda:GetFunctionConfiguration` degrades to accepted-but-unverified
     * rather than failing a rollout that almost certainly succeeded.
     */
    private waitForUpdateCompletion;
}