/**
 * Internal pod-identity + host-binding machinery behind the `aws-eks`
 * cluster adapter's workload-identity implementation (see
 * `../KubernetesAdapter.ts`). Each helper is an independently idempotent
 * mini-reconciler: observe, ensure, converge.
 */
import * as eks from "@distilled.cloud/aws/eks";
import * as iam from "@distilled.cloud/aws/iam";
import * as Effect from "effect/Effect";
import type { ResourceBinding } from "../../../Resource.ts";
import type { PolicyStatement } from "../../IAM/Policy.ts";
export declare const toClientRequestToken: (id: string, action: string) => Effect.Effect<string, never, import("../../../InstanceId.ts").InstanceId | import("../../../Stack.ts").Stack | import("../../../Stage.ts").Stage>;
/**
 * Ensure the pod-identity IAM role exists (trusts `pods.eks.amazonaws.com`).
 * Idempotent: creates on miss, adopts a role we already own on race.
 */
export declare const ensurePodRole: (args_0: {
    id: string;
    roleName: string;
    managedPolicyArns?: string[];
}) => Effect.Effect<string, Error | import("effect/unstable/http/HttpClientError").HttpClientError, import("@distilled.cloud/aws/Credentials").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("../../../Stack.ts").Stack | import("../../../Stage.ts").Stage>;
export interface HostBindingContract {
    env?: Record<string, any>;
    policyStatements?: PolicyStatement[];
}
/**
 * Land the IAM policy statements carried by a host's active bindings as
 * the pod role's inline policy (or delete it when no statements remain).
 * Binding env collection is generic and lives in the Kubernetes workload
 * providers.
 */
export declare const attachPolicyStatements: (args_0: {
    roleName: string;
    policyName: string;
    bindings: ResourceBinding<HostBindingContract>[];
}) => Effect.Effect<void, import("@distilled.cloud/aws/Errors").AccessDeniedException | import("@distilled.cloud/aws/Errors").EndpointError | import("@distilled.cloud/aws/Errors").ExpiredTokenException | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/aws/Errors").IncompleteSignature | import("@distilled.cloud/aws/Errors").InternalFailure | iam.LimitExceededException | import("@distilled.cloud/aws/Errors").MalformedHttpRequestException | iam.MalformedPolicyDocumentException | import("@distilled.cloud/aws/Errors").NoMatchingRuleError | iam.NoSuchEntityException | import("@distilled.cloud/aws/Errors").NotAuthorized | import("@distilled.cloud/aws/Errors").OperationAborted | import("@distilled.cloud/aws/Errors").OptInRequired | import("@distilled.cloud/aws/Errors").RequestAbortedException | import("@distilled.cloud/aws/Errors").RequestEntityTooLargeException | import("@distilled.cloud/aws/Errors").RequestExpired | import("@distilled.cloud/aws/Errors").RequestTimeoutException | iam.ServiceFailureException | import("@distilled.cloud/aws/Errors").ServiceUnavailable | import("@distilled.cloud/aws/Errors").ThrottlingException | import("@distilled.cloud/aws/Errors").UnknownAwsError | import("@distilled.cloud/aws/Errors").UnknownOperationException | iam.UnmodifiableEntityException | import("@distilled.cloud/aws/Errors").UnrecognizedClientException | import("@distilled.cloud/aws/Errors").ValidationError | import("@distilled.cloud/aws/Errors").ValidationException, import("@distilled.cloud/aws/Credentials").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
/** Observe an existing pod identity association for (cluster, ns, sa). */
export declare const findAssociation: (args_0: {
    clusterName: string;
    namespace: string;
    serviceAccount: string;
}) => Effect.Effect<{
    associationArn: string;
    associationId: string;
    roleArn: string | undefined;
} | undefined, import("@distilled.cloud/aws/Errors").AccessDeniedException | import("@distilled.cloud/aws/Errors").EndpointError | import("@distilled.cloud/aws/Errors").ExpiredTokenException | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/aws/Errors").IncompleteSignature | import("@distilled.cloud/aws/Errors").InternalFailure | eks.InvalidParameterException | eks.InvalidRequestException | import("@distilled.cloud/aws/Errors").MalformedHttpRequestException | import("@distilled.cloud/aws/Errors").NoMatchingRuleError | import("@distilled.cloud/aws/Errors").NotAuthorized | import("@distilled.cloud/aws/Errors").OperationAborted | import("@distilled.cloud/aws/Errors").OptInRequired | import("@distilled.cloud/aws/Errors").RequestAbortedException | import("@distilled.cloud/aws/Errors").RequestEntityTooLargeException | import("@distilled.cloud/aws/Errors").RequestExpired | import("@distilled.cloud/aws/Errors").RequestTimeoutException | eks.ResourceNotFoundException | eks.ServerException | import("@distilled.cloud/aws/Errors").ServiceUnavailable | import("@distilled.cloud/aws/Errors").ThrottlingException | import("@distilled.cloud/aws/Errors").UnknownAwsError | import("@distilled.cloud/aws/Errors").UnknownOperationException | import("@distilled.cloud/aws/Errors").UnrecognizedClientException | import("@distilled.cloud/aws/Errors").ValidationError | import("@distilled.cloud/aws/Errors").ValidationException, import("@distilled.cloud/aws/Credentials").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
/** Ensure the pod identity association exists and points at roleArn. */
export declare const ensureAssociation: (args_0: {
    id: string;
    clusterName: string;
    namespace: string;
    serviceAccount: string;
    roleArn: string;
}) => Effect.Effect<{
    associationArn: string;
    associationId: string;
}, Error | import("effect/unstable/http/HttpClientError").HttpClientError, import("@distilled.cloud/aws/Credentials").Credentials | import("effect/unstable/http/HttpClient").HttpClient | import("../../../InstanceId.ts").InstanceId | import("../../../Stack.ts").Stack | import("../../../Stage.ts").Stage>;
/** Delete the pod identity association; missing is success. */
export declare const deleteAssociation: (args_0: {
    clusterName: string;
    associationId: string;
}) => Effect.Effect<void, eks.InvalidParameterException | eks.InvalidRequestException | eks.ServerException | import("@distilled.cloud/aws/Errors").CommonErrors, import("@distilled.cloud/aws/Credentials").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
/**
 * Fully delete a pod IAM role: inline policies, managed-policy attachments,
 * then the role itself. Idempotent throughout.
 */
export declare const deletePodRole: (roleName: string) => Effect.Effect<void, iam.ConcurrentModificationException | iam.DeleteConflictException | iam.InvalidInputException | iam.LimitExceededException | iam.ServiceFailureException | iam.UnmodifiableEntityException | import("@distilled.cloud/aws/Errors").CommonErrors, import("@distilled.cloud/aws/Credentials").Credentials | import("effect/unstable/http/HttpClient").HttpClient>;
//# sourceMappingURL=podIdentity.d.ts.map