/**
 * Principal extractors for the TL-PERM permission-gap checks.
 *
 * A "principal" is a compute resource that assumes an IAM role and references
 * other resources it presumably calls at runtime (via environment variables).
 * Each extractor knows one resource type; adding coverage for a new compute
 * type means adding one extractor here - the coverage engine is unchanged.
 */
import type { CloudFormationResource } from '../../../types/analysis.types';
export interface PrincipalEdge {
    /** Logical id of the referenced resource. */
    targetId: string;
    /** Human-readable description of where the reference was found. */
    via: string;
}
export interface PrincipalRef {
    /** Logical id of the compute resource. */
    principalId: string;
    /** e.g. "Lambda function", "ECS task definition". */
    principalLabel: string;
    /** Logical id of the in-template execution role, or null. */
    roleId: string | null;
    /**
     * True when the principal PROVABLY has no role at all (e.g. an ECS task
     * definition without TaskRoleArn) - a stronger signal than an unresolvable
     * role (roleId null, roleProvablyAbsent false), which callers must skip.
     */
    roleProvablyAbsent: boolean;
    edges: PrincipalEdge[];
}
/**
 * Extract every supported compute principal and its environment-variable
 * reference edges from a template's resources.
 */
export declare const extractEnvReferencePrincipals: (resources: Record<string, CloudFormationResource>) => PrincipalRef[];