import type { ScanFinding } from "../types.js";
/** Cloud provider profile (AWS profile, GCP project, Azure subscription) */
export interface CloudProfile {
    name: string;
    provider: "aws" | "gcp" | "azure";
    accountId?: string;
    metadata?: Record<string, string>;
}
/** A region/location within a cloud provider */
export interface CloudRegion {
    code: string;
    name: string;
}
/** Permission check result for a scanner module */
export interface PermissionCheck {
    module: string;
    hasPermission: boolean;
    missingPermissions: string[];
}
/** Scanner module interface — each module (EC2, S3, etc.) implements this */
export interface ScannerModule {
    /** Unique module name */
    name: string;
    /** Display label */
    label: string;
    /** Required IAM permissions */
    requiredPermissions: string[];
    /** Run the scan and return findings */
    scan(config: ScanConfig): Promise<ScanFinding[]>;
}
/** Explicit AWS credentials (from STS AssumeRole) */
export interface AssumedCredentials {
    accessKeyId: string;
    secretAccessKey: string;
    sessionToken: string;
    expiration?: Date;
}
/** Configuration passed to each scanner module */
export interface ScanConfig {
    region: string;
    profile: string;
    /** Human-readable account alias, when available (AWS IAM) */
    accountAlias?: string;
    /** Custom endpoint URL (e.g. http://localhost:4566 for LocalStack) */
    endpointUrl?: string;
    /** Pre-assumed credentials — when provided, profile is ignored */
    credentials?: AssumedCredentials;
    /** Opt-in flag: suggest scaling non-prod ECS/Fargate services to zero on weekends */
    suggestWeekendScaleDown?: boolean;
}
export interface CredentialValidation {
    valid: boolean;
    accountId?: string;
    userArn?: string;
}
/** Cloud provider interface — AWS, GCP, Azure each implement this */
export interface CloudProvider {
    name: "aws" | "gcp" | "azure";
    label: string;
    /** Detect available profiles/credentials */
    detectProfiles(): Promise<CloudProfile[]>;
    /** List available regions */
    listRegions(): CloudRegion[];
    /** Quick validation that the current credentials work */
    validateCredentials(profile: string, region: string, endpointUrl?: string): Promise<CredentialValidation>;
    /** Check which modules the current credentials can access */
    checkPermissions(profile: string, region: string, endpointUrl?: string): Promise<PermissionCheck[]>;
    /** Get all scanner modules */
    getModules(): ScannerModule[];
}