import { type SecretsManagerClientConfig } from "@aws-sdk/client-secrets-manager";
import type { PoolQueryClient } from "../../generated/storage-kit/query.js";
import { PostgresStorage } from "./postgres.js";
export declare const PROVIDER_CREDENTIAL_SPECS: Readonly<{
    migrator: Readonly<{
        login: "open_loops_migrator_login";
        secretOption: "migratorSecretArn";
    }>;
    runtime: Readonly<{
        login: "open_loops_runtime_login";
        secretOption: "runtimeSecretArn";
        role: "open_loops_runtime";
    }>;
    authenticator: Readonly<{
        login: "open_loops_authenticator_login";
        secretOption: "authenticatorSecretArn";
        role: "open_loops_authenticator";
    }>;
}>;
type CredentialPurpose = keyof typeof PROVIDER_CREDENTIAL_SPECS;
type ServicePurpose = Exclude<CredentialPurpose, "migrator">;
type CredentialPhase = "pre_0010" | "post_0010";
type SecretStage = "AWSCURRENT" | "AWSPENDING";
export interface ProviderCredentialOptions {
    region: string;
    credentialsRelativeUri: string;
    masterSecretArn: string;
    migratorSecretArn: string;
    runtimeSecretArn: string;
    authenticatorSecretArn: string;
    expectedInstanceId: string;
    expectedEndpoint: string;
    expectedPort: number;
    expectedDatabase: string;
    expectedMasterUsername: string;
}
interface SecretValue {
    value: string;
    versionId: string;
}
type ProviderCredentialFetch = (input: string, init?: RequestInit) => Promise<Response>;
export interface ProviderCredentialSecretStore {
    get(secretId: string, stage: SecretStage): Promise<SecretValue | undefined>;
    putPending(secretId: string, value: string): Promise<SecretValue>;
    promote(secretId: string, pendingVersionId: string, currentVersionId?: string): Promise<void>;
}
interface CredentialInspection {
    valid: boolean;
    enforcementApplied: boolean;
}
export interface ProviderCredentialDatabase {
    bootstrapBeforeSecrets(): Promise<void>;
    setPassword(purpose: CredentialPurpose, password: string): Promise<void>;
    inspectCredential(purpose: CredentialPurpose, dsn: string, attached: boolean): Promise<CredentialInspection>;
    probeMigrator(dsn: string): Promise<CredentialPhase>;
    attachService(purpose: ServicePurpose): Promise<void>;
    detachService(purpose: ServicePurpose): Promise<void>;
    close(): Promise<void>;
}
export interface ProviderCredentialResult {
    phase: CredentialPhase;
    status: "ok";
    invariants: {
        bootstrapNormalized: true;
        transportVerified: true;
        ledgerExact: true;
        serviceMembershipsSafe: true;
    };
    affectedSecrets: number;
}
export interface ProviderCredentialDependencies {
    secretStore?: ProviderCredentialSecretStore;
    createDatabase?: (masterDsn: string, probe: BootstrapProbe) => ProviderCredentialDatabase;
    random?: (bytes: number) => Uint8Array;
    bootstrapProbe: BootstrapProbe;
}
export type BootstrapProbe = (client: PoolQueryClient, schema: PostgresStorage) => Promise<void>;
export declare function resolveProviderCredentialOptions(env?: NodeJS.ProcessEnv): ProviderCredentialOptions;
export declare function reconcileProviderCredentials(options: ProviderCredentialOptions, dependencies: ProviderCredentialDependencies): Promise<ProviderCredentialResult>;
export declare function logProviderCredentialSuccess(result: ProviderCredentialResult): void;
export declare function createAwsSecretsManagerClientConfig(options: ProviderCredentialOptions, fetchImpl?: ProviderCredentialFetch): SecretsManagerClientConfig;
export declare const PROVIDER_BOOTSTRAP_MEMBERSHIPS_SQL: string;
export declare const PROVIDER_BOOTSTRAP_INVARIANT_SQL: string;
export {};