import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import * as Binding from "../../Binding.ts";
import type { MicrovmImage } from "./MicrovmImage.ts";
/** The distilled operation method, yielded to its request callable. */
type Operation<Res, Err> = Effect.Effect<(req: any) => Effect.Effect<Res, Err, any>, any, any>;
export interface ImageBindingOptions<Req, Res, Err, Self> {
    /** The `Binding.Service` contract this layer implements. */
    binding: Binding.Service<Self, string, (image: MicrovmImage) => Effect.Effect<(req: Req) => Effect.Effect<Res, Err>>>;
    /** Operation name, used for the SID label and tracing, e.g. `"RunMicrovm"`. */
    name: string;
    /** IAM action(s) the host Function needs, e.g. `["lambda:RunMicrovm"]`. */
    actions: string[];
    /** The distilled operation, e.g. `microvms.runMicrovm`. */
    operation: Operation<Res, Err>;
    /**
     * Policy scope (always limited to the bound image's identity — never `["*"]`):
     * - `"image"` (default) scopes to the exact image ARN (e.g. `RunMicrovm`,
     *   image-read ops).
     * - `"microvm"` scopes to the MicroVM instances launched from this image via
     *   a `microvm:*` glob derived from the image ARN (same partition, region,
     *   and account). MicroVM instance ARNs are minted at runtime, so an exact
     *   ARN can't be known at deploy time, but the action stays bounded to this
     *   account/region's MicroVMs rather than `["*"]`.
     * - `"account"` uses `["*"]`. Reserved for collection-level list actions
     *   (e.g. `ListMicrovms`) that AWS only authorizes against `*` and cannot be
     *   resource-scoped, analogous to `ec2:DescribeInstances`.
     */
    scope?: "image" | "microvm" | "account";
    /** Inject `imageIdentifier: <imageArn>` into each request. */
    injectImageIdentifier?: boolean;
    /**
     * Also grant `lambda:PassNetworkConnector` on network connectors in the
     * image's region — both the account's own connectors and the AWS-managed
     * ones (e.g. `INTERNET_EGRESS`). Required by `RunMicrovm`, which passes a
     * network connector (defaulting to the managed `INTERNET_EGRESS`) to the
     * launched MicroVM.
     */
    passNetworkConnector?: boolean;
}
/**
 * Build a MicroVM runtime binding bound to a {@link MicrovmImage}. At deploy it
 * registers the IAM grant on the host — the Lambda execution role directly, or
 * (for a Cloudflare Worker) a dedicated assume-role Role whose credentials are
 * bound onto the worker. At runtime it calls the distilled operation with the
 * host-appropriate credentials.
 */
export declare const makeImageBinding: <Req, Res, Err, Self>(options: ImageBindingOptions<Req, Res, Err, Self>) => Layer.Layer<Self>;
export interface AccountBindingOptions<Req, Res, Err, Self> {
    binding: Binding.Service<Self, string, () => Effect.Effect<(req: Req) => Effect.Effect<Res, Err>>>;
    name: string;
    actions: string[];
    operation: Operation<Res, Err>;
}
/**
 * Build an account-scoped MicroVM binding (no resource argument), e.g. for
 * listing AWS-managed base images. IAM `Resource` is `["*"]`.
 */
export declare const makeAccountBinding: <Req, Res, Err, Self>(options: AccountBindingOptions<Req, Res, Err, Self>) => Layer.Layer<Self>;
export {};
//# sourceMappingURL=MicrovmBinding.d.ts.map