import { SeedBucketObject, EcsNetworkConfiguration, EcsRunTaskInput, EcsTaskStatus, LogEvent } from './types.js';
/** run-task and describe-tasks calls just submit/read state - short timeout is fine.
 * The long-running part (waiting for the seed to finish) is a polling loop in
 * waitForTaskCompletion, not a single blocking AWS CLI call. */
/**
 * List all objects in the seed bucket (key + LastModified).
 */
export declare function listSeedBucketObjects(bucket: string, profile: string, verbose?: boolean): SeedBucketObject[];
/**
 * Resolve the AWS account ID for the given profile by calling `aws sts get-caller-identity`.
 *
 * Used to assert (before any network discovery or run-task call) that the
 * resolved target profile actually points at the account the seed env expects -
 * see `assertAccountMatchesEnv` in ./types.js.
 *
 * @param profile - AWS CLI profile name
 * @param verbose - when true, prints the resolved account ID to stdout
 * @returns 12-digit AWS account ID string
 * @throws Error if the STS call exits non-zero or output cannot be parsed
 */
export declare function resolveAccountId(profile: string, verbose?: boolean): string;
/**
 * Look up a VPC ID by its Name tag.
 */
export declare function getVpcIdByNameTag(vpcName: string, profile: string, verbose?: boolean): string;
/**
 * List subnet IDs tagged Type=private within a VPC (NAT egress subnets).
 */
export declare function getPrivateSubnetIds(vpcId: string, profile: string, verbose?: boolean): string[];
/**
 * Look up a security group ID by group-name within a VPC.
 */
export declare function getSecurityGroupIdByName(vpcId: string, groupName: string, profile: string, verbose?: boolean): string;
/**
 * Discover the awsvpc network configuration for the roma-seeder task in the
 * target account: private subnets in the account's VPC (tagged Name=<alias>),
 * plus the roma-seeder-task and product-cluster-instances security groups.
 */
export declare function discoverNetworkConfiguration(accountAlias: string, profile: string, verbose?: boolean): EcsNetworkConfiguration;
/**
 * Launch the roma-seeder task via `aws ecs run-task` and return its task ARN.
 */
export declare function runEcsTask(input: EcsRunTaskInput, profile: string, verbose?: boolean): string;
/**
 * Describe an ECS task and return its status and container exit codes.
 */
export declare function describeEcsTask(cluster: string, taskArn: string, profile: string, verbose?: boolean): EcsTaskStatus;
/**
 * Find the CloudWatch log stream for a given task ID within a log group.
 * Returns undefined (never throws) if the log group/stream isn't there yet -
 * this is expected right after a task starts, before its first log line lands.
 */
export declare function findLogStreamName(logGroup: string, taskId: string, profile: string, verbose?: boolean): string | undefined;
/**
 * Fetch a page of log events for a log stream, starting from the head on the
 * first call and continuing forward via nextToken on subsequent calls.
 */
export declare function getLogEvents(logGroup: string, logStreamName: string, nextToken: string | undefined, profile: string, verbose?: boolean): {
    events: LogEvent[];
    nextForwardToken?: string;
};
/** Options controlling the wait-for-completion poll loop. */
export interface WaitForTaskCompletionOptions {
    /** Delay between polls in ms. Default: 5000. */
    pollIntervalMs?: number;
    /** Injectable sleep function - override in tests to avoid real delays. */
    sleep?: (ms: number) => Promise<void>;
    /** Called with each new batch of log events as they arrive. */
    onLogEvents?: (events: LogEvent[]) => void;
    verbose?: boolean;
    /**
     * Consecutive transient AWS-call failures (describe-tasks / get-log-events)
     * tolerated before giving up. Default: 5. A genuine task STOP (even with a
     * non-zero container exit code) is a real result, not a transient failure -
     * it is always returned immediately and never counted here.
     */
    maxConsecutiveFailures?: number;
    /** Called each time a transient failure is tolerated and the loop retries. */
    onTransientFailure?: (error: Error, attempt: number, maxConsecutiveFailures: number) => void;
    /**
     * Overall wall-clock deadline for the whole wait, in ms, independent of
     * `maxConsecutiveFailures` (which only bounds consecutive AWS-call errors,
     * not a legitimately-stuck task that keeps reporting PENDING/RUNNING - e.g.
     * a Fargate capacity stall or a hung seeder process). Default: 45 minutes
     * (2,700,000ms) - generous for a ~1.2 GiB restore. When exceeded, throws
     * instead of polling forever, so `padua seed` fails closed.
     */
    maxWaitMs?: number;
    /** Injectable clock - override in tests. Default: Date.now. */
    now?: () => number;
}
/**
 * Poll an ECS task until it stops, streaming any new CloudWatch log events as
 * they appear, then return the final task status (including container exit
 * codes) for the caller to report success/failure.
 *
 * Transient AWS-call failures (a describe-tasks or get-log-events call throwing
 * because of a network blip, throttling, etc.) are tolerated up to
 * `maxConsecutiveFailures` in a row - the loop logs a warning and keeps polling.
 * The counter resets on every successful poll, so isolated blips never
 * accumulate across a multi-minute wait. Only `maxConsecutiveFailures`
 * consecutive failures give up (rethrowing the last error). A real task STOP -
 * even with a failing container exit code - is not a transient failure and is
 * always returned immediately.
 *
 * Independently, the whole wait is bounded by `maxWaitMs` overall wall-clock
 * time - a task stuck in PENDING/RUNNING forever (no errors, just never
 * finishing) throws a clear timeout error instead of polling indefinitely.
 */
export declare function waitForTaskCompletion(cluster: string, taskArn: string, taskId: string, logGroup: string, profile: string, options?: WaitForTaskCompletionOptions): Promise<EcsTaskStatus>;
//# sourceMappingURL=aws.d.ts.map