/**
 * Types and pure helpers for the seed command.
 *
 * `padua seed <system> [env]` seeds a non-production Roma MySQL database from a
 * dated backup held in the `paduafg-roma-mysql-seed` S3 bucket (dev account) by
 * launching the `roma-seeder` ECS task on Fargate.
 */
/** Systems supported by `padua seed`. Only 'roma' is supported today. */
export type SeedSystem = 'roma';
export declare const SUPPORTED_SYSTEMS: readonly SeedSystem[];
/** Environments that can be seeded via this command. */
export type SeedEnv = 'test' | 'sit-dev' | 'uat-dev' | 'preprod';
export declare const SEED_ENVS: readonly SeedEnv[];
export declare const DEFAULT_SEED_ENV: SeedEnv;
/** Seed data tiers held as dated keys in the seed bucket. */
export type SeedTier = 'stage' | 'preprod' | 'dev';
/** AWS account alias (see src/shared/aws-accounts.ts) that owns each seed env. */
export declare const ENV_ACCOUNT_ALIAS: Record<SeedEnv, 'development' | 'preproduction'>;
/** Seed bucket tier that backs each seed env. */
export declare const ENV_TIER: Record<SeedEnv, SeedTier>;
/**
 * RDS cluster identifier the seeder connects to (passed as the CLUSTER env var).
 *
 * Per-env rather than one constant (IOPS-1580). The roma re-platform (IOPS-1438)
 * runs both platforms side by side, so no single value is correct: `test` already
 * lives on the new `roma-app` cluster, while sit-dev/uat-dev/preprod are still
 * served by the legacy `roma-backend` cluster.
 *
 * Both failure modes are real, which is why a blanket rename is NOT the fix:
 * - leaving `test` on `roma-backend` writes a ~1.24 GB database into
 *   infrastructure that is still serving live sit-dev/uat-dev traffic, and
 *   silently fails to seed the new platform;
 * - flipping everything to `roma-app` breaks seeding for the legacy envs.
 *
 * Move an entry to `roma-app` as that environment cuts over (IOPS-1459).
 */
export declare const ENV_DB_CLUSTER: Record<SeedEnv, string>;
/** The seed bucket lives in the development account - always list it with this profile. */
export declare const DEV_PROFILE = "paduafg-development";
export declare const SEED_BUCKET = "paduafg-roma-mysql-seed";
export declare const ECS_CLUSTER = "product-cluster";
export declare const TASK_FAMILY = "roma-seeder";
export declare const CONTAINER_NAME = "roma-seeder";
export declare const LOG_GROUP = "/ecs/roma-seeder";
/** Secrets Manager secret holding the preprod app DB password (GetSecretValue by the seeder). */
export declare const PREPROD_SECRET_NAME = "roma-app-preproduction-ssDatabasePassword";
/** Security group names the run-task network configuration must include. */
export declare const SEED_SG_TASK_NAME = "roma-seeder-task";
export declare const SEED_SG_CLUSTER_NAME = "product-cluster-instances";
/** CloudWatch Logs stream-name prefix set on the roma-seeder task definition (awslogs-stream-prefix). */
export declare const LOG_STREAM_PREFIX = "roma-seeder/roma-seeder/";
/**
 * Resolve the AWS profile for the account that owns the given seed env.
 */
export declare function profileForEnv(env: SeedEnv): string;
/**
 * Resolve the RDS cluster identifier the seeder should connect to for the given
 * seed env. See ENV_DB_CLUSTER for why this is per-env (IOPS-1580).
 */
export declare function dbClusterForEnv(env: SeedEnv): string;
/**
 * Assert that the AWS account behind `profile` (identified by `accountId`, from
 * `sts get-caller-identity`) is actually the account the given seed env requires.
 *
 * `--profile`/ambient `AWS_PROFILE` can point the CLI at a different account than
 * the one `env` implies - this is the last line of defense before any network
 * discovery or run-task call touches that account. A mismatch (including the
 * account resolving to production, or to an account not in the alias map at all)
 * is always refused - never seeded.
 *
 * @throws Error with a message identifying the profile, resolved account/alias,
 *   the env, and the alias that was expected
 */
export declare function assertAccountMatchesEnv(profile: string, accountId: string, env: SeedEnv): void;
/**
 * Assert that the AWS account behind `profile` (identified by `accountId`, from
 * `sts get-caller-identity`) is genuinely the development account.
 *
 * Symmetric with `assertAccountMatchesEnv`: that function guards the target
 * account (network discovery + run-task); this guards `DEV_PROFILE`, which is
 * always used to list the seed bucket (the bucket lives in dev regardless of
 * which env is being seeded) and must never be allowed to silently point
 * somewhere else.
 *
 * @throws Error with a message identifying the profile and the resolved account/alias
 */
export declare function assertDevAccountIdentity(profile: string, accountId: string): void;
/** Check whether a system string is supported (case-insensitive). */
export declare function isSupportedSystem(system: string): boolean;
/**
 * Validate the `<system>` argument. Throws a friendly error for anything but 'roma'.
 */
export declare function validateSystem(system: string): void;
/** Check whether a string is one of the supported seed envs. */
export declare function isSeedEnv(value: string): value is SeedEnv;
/**
 * Validate and normalize the `[env]` argument.
 *
 * `dev` is local-dev only and is never seeded via AWS. `prod`/`production` is
 * never seeded here - production uses snapshot/restore (see IOPS-1457).
 *
 * @returns the normalized (lower-cased) SeedEnv
 * @throws Error with a message explaining why the value was rejected
 */
export declare function validateEnv(env: string): SeedEnv;
/** A single object listed from the seed bucket. */
export interface SeedBucketObject {
    key: string;
    lastModified?: string;
}
/**
 * Pick the newest dated key for a given tier from a list of bucket objects.
 *
 * Keys are named `<YYYY-MM-DD>_09_<tier>.sql`. Only keys matching the requested
 * tier are considered; the newest by date prefix wins (ISO dates sort lexically).
 *
 * @returns the matching key, or undefined if no key matches the tier
 */
export declare function pickLatestDatedKey(objects: SeedBucketObject[], tier: SeedTier): string | undefined;
/** A single container override environment variable (aws ecs run-task shape). */
export interface ContainerEnvVar {
    name: string;
    value: string;
}
/**
 * Build the roma-seeder container environment variables for a given seed env
 * and resolved seed key. `SECRET` is included only for preprod - dev-tier envs
 * pass no SECRET (the seeder falls back to the plaintext, sanitized user as
 * the dev password).
 */
export declare function buildContainerEnvironment(env: SeedEnv, key: string): ContainerEnvVar[];
/** Fargate awsvpc network configuration for the run-task call. */
export interface EcsNetworkConfiguration {
    subnets: string[];
    securityGroups: string[];
    assignPublicIp: 'ENABLED' | 'DISABLED';
}
/** Fully resolved input to launch the roma-seeder task. */
export interface EcsRunTaskInput {
    cluster: string;
    taskDefinition: string;
    launchType: 'FARGATE';
    containerName: string;
    networkConfiguration: EcsNetworkConfiguration;
    environment: ContainerEnvVar[];
}
/**
 * Assemble the full run-task input for a seed operation.
 */
export declare function buildRunTaskInput(env: SeedEnv, key: string, networkConfiguration: EcsNetworkConfiguration): EcsRunTaskInput;
/** The exact JSON shapes passed to `aws ecs run-task --network-configuration` / `--overrides`. */
export interface EcsRunTaskCliPayload {
    networkConfiguration: {
        awsvpcConfiguration: EcsNetworkConfiguration;
    };
    overrides: {
        containerOverrides: Array<{
            name: string;
            environment: ContainerEnvVar[];
        }>;
    };
}
/**
 * Convert an EcsRunTaskInput into the JSON payload shapes the AWS CLI expects
 * for `--network-configuration` and `--overrides`. Used for both the real
 * run-task call and the `--dry-run` plan printout, so both stay in sync.
 */
export declare function buildRunTaskCliPayload(input: EcsRunTaskInput): EcsRunTaskCliPayload;
/** Extract the task ID (last path segment) from an ECS task ARN. */
export declare function extractTaskId(arn: string): string;
/** Status of a single container within an ECS task. */
export interface EcsContainerStatus {
    name: string;
    exitCode?: number;
    reason?: string;
}
/** Status of an ECS task, as returned by describe-tasks. */
export interface EcsTaskStatus {
    lastStatus: string;
    stopCode?: string;
    stoppedReason?: string;
    containers: EcsContainerStatus[];
}
/** A single CloudWatch Logs event. */
export interface LogEvent {
    timestamp?: number;
    message: string;
}
/** Options for the `padua seed` command. */
export interface SeedOptions {
    profile?: string;
    dryRun?: boolean;
    verbose?: boolean;
    noColor?: boolean;
    /** Skip the confirmation prompt before launching the (destructive) seed task. */
    yes?: boolean;
}
//# sourceMappingURL=types.d.ts.map