/**
 * The aws `ReceiptStore` (#1835, epic #1703) — core's injectable receipt seam
 * (#1834, `@intentius/chant/op/receipt-store`) implemented over SSM Parameter
 * Store, plain `String`, at the path identity ./effect-receipt-row.ts derives
 * from the ownership marker fields.
 *
 * The transport is the lexicon's own read/apply transport (./api/read-client,
 * #1206), pointed at the SSM JSON API: `fetch`, SigV4 when credentials
 * resolve, and the one endpoint-override rule (#1694) — the `endpoint`
 * option, else `AWS_ENDPOINT_URL_SSM`, else `AWS_ENDPOINT_URL` — so a local
 * emulator lane reads and writes receipts without any store-specific wiring.
 *
 * Write discipline (epic decision 3): `write` exists for the `effect()` step
 * alone — the step's read-compare-run-write is the only path that reaches it,
 * on success, last. `PutParameter` is `Type: "String"` always; the first
 * write creates the parameter with the ownership tags, and a later write
 * overwrites the value (SSM refuses `Overwrite` and `Tags` in one call, so
 * tags ride creation only — they never change after).
 *
 * Identity: the parameter name needs `<stack>` and `<env>`, which the
 * activity args deliberately do not carry (the `EffectReceiptRef` is
 * identity-of-the-effect, not identity-of-the-deployment). The store resolves
 * them once, lazily, at first use: an explicit option, else `CHANT_ENV` (what
 * `chant run --env` sets) and the project's `ownership` block — the same
 * fields that stamp markers (epic decision 4). Nothing resolving is an error,
 * never a guessed segment.
 */
import type { ReceiptStore } from "@intentius/chant/op/receipt-store";
import type { ResourceMetadata } from "@intentius/chant/lexicon";
import type { UnobservedReason } from "@intentius/chant/observation";
import { type AwsCredentialSource, type AwsReadClientOptions, type AwsReadHttp } from "./api/read-client.js";
/** Options for {@link awsReceiptStore}. All optional: the default store reads
 * its identity from the project and its endpoint from the environment. */
export interface AwsReceiptStoreOptions {
    /** The path's `<stack>` segment. Omitted, the project's `ownership.stack`
     * (chant.config.ts, found upward from `cwd`) answers. */
    stack?: string;
    /** The path's `<env>` segment — explicit by decision 4. Omitted, `CHANT_ENV`
     * (set by `chant run --env`) answers, then a literal `ownership.env`. */
    environment?: string;
    /** Where to look for chant.config.ts. Defaults to the working directory. */
    cwd?: string;
    /** Endpoint override; omitted, `AWS_ENDPOINT_URL[_SSM]` answers (#1694). */
    endpoint?: string;
    /** Region for the real-AWS host. */
    region?: string;
    /** Injectable HTTP, mirroring the read client's. Tests avoid the network. */
    http?: AwsReadHttp;
    /** Environment record the endpoint/credential/identity fallbacks read.
     * Defaults to `process.env`; injectable for tests. */
    env?: Record<string, string | undefined>;
    /** What to sign with — same seam as the read client. */
    credentials?: AwsCredentialSource;
    /** Sign even against an endpoint override — for an override that is real AWS. */
    signEndpointOverride?: boolean;
}
/** One SSM JSON call. Exported for the observation leg (plugin.ts), which
 * reads the same parameters the store writes. */
export declare function ssmCall(action: string, payload: Record<string, unknown>, options: AwsReadClientOptions): Promise<{
    status: number;
    json: Record<string, unknown>;
}>;
/** The API's own error code from a JSON-protocol error body — `__type`, with
 * any `namespace#` prefix stripped. */
export declare function ssmErrorCode(json: Record<string, unknown>): string | undefined;
/**
 * `GetParameter` by name. Absent (`ParameterNotFound`) is `undefined` — a real
 * answer, distinct from a failed read, which throws.
 */
export declare function ssmGetParameter(name: string, options?: AwsReadClientOptions): Promise<string | undefined>;
/**
 * `PutParameter`, plain `String`. Creation carries `tags`; an existing
 * parameter is overwritten (`Overwrite: true`) without them — SSM refuses
 * `Overwrite` and `Tags` in the same call, and ownership tags never change.
 */
export declare function ssmPutParameter(name: string, value: string, tags: Record<string, string>, options?: AwsReadClientOptions): Promise<void>;
/** What the observation leg learned about the declared receipt rows. */
export interface ReceiptRowObservation {
    resources: Record<string, ResourceMetadata>;
    unobserved: Record<string, {
        type: string;
        reason: UnobservedReason;
        detail: string;
    }>;
}
/**
 * The plan-side live read of the receipt rows (#1835's observation leg).
 *
 * A receipt is not a stack member — the applier never writes it (#1832) — so
 * `describe-stack-resources` honestly reports it absent even while the
 * parameter exists. The serializer renders each receipt's derived path into
 * the template's `Metadata` (./serializer.ts), so this leg reads the paths
 * back from the build output — one derivation, decision 4 — and asks SSM
 * `GetParameter` for each. Present maps the stored value onto
 * `attributes.value` (core's `RECEIPT_VALUE_ATTRIBUTE`); `ParameterNotFound`
 * is a real absence and stays one; a failed read is an `unobserved` hole,
 * never a wrong answer — a receipt nobody could read must not arrive
 * downstream as "the effect never ran".
 */
export declare function observeReceiptRows(entityNames: string[], buildOutput: string, options?: AwsReadClientOptions): Promise<ReceiptRowObservation>;
/**
 * The `ReceiptStore` over SSM. Bind it once in the op activities barrel —
 * `receiptActivities(awsReceiptStore())` — and the registry resolves
 * `receiptRead`/`receiptWrite`/`receiptStaleness` by name, exactly like
 * `ensureSecret` (#1830). Identity and endpoint resolve lazily at first use,
 * so module load never reads the project or the environment.
 */
export declare function awsReceiptStore(options?: AwsReceiptStoreOptions): ReceiptStore;
//# sourceMappingURL=receipt-store.d.ts.map