/**
 * CloudWatch Logs connector.
 *
 * Uses FilterLogEvents for scoped retrieval across one or more log groups.
 * Supports wildcard log-group patterns via DescribeLogGroups (`/aws/ecs/*`).
 *
 * Credential discovery:
 *   - `env`: explicit AWS_* env vars present (AWS_ACCESS_KEY_ID + AWS_REGION, etc.)
 *   - `ambient`: defaultProvider() resolves credentials from the chain
 *     (instance metadata, ~/.aws/credentials, SSO cache, etc.)
 *   - `none`: nothing resolvable
 *
 * Pagination: FilterLogEvents returns nextToken; we paginate until
 * targetEventCount reached, time exhausted, or the API says "no more".
 *
 * Rate limiting: AWS throttling exceptions are retried with exponential
 * backoff. Transient 5xx errors are retried up to 3× per request.
 */
import { GetMetricDataCommand } from '@aws-sdk/client-cloudwatch';
import type { SiemConnector } from './index.js';
/**
 * Default stratified-sampling bucket count for CloudWatch pulls.
 *
 * Exported because the offline export-plan emitter
 * (`lib/siem/export-plan/cloudwatch.ts`) renders a shell script that must
 * draw the SAME sample this connector draws — same bucket count, same
 * per-bucket cap — or a fenced POC and a live POC over the same window
 * would report different pattern mixes for reasons that have nothing to do
 * with the logs. One constant, two callers.
 */
export declare const CLOUDWATCH_BUCKET_COUNT = 24;
/** Per-request event ceiling CloudWatch's FilterLogEvents accepts. */
export declare const CLOUDWATCH_PAGE_LIMIT = 10000;
/**
 * Billed daily ingest from the AWS/Logs `IncomingBytes` metric: the exact
 * uncompressed bytes CloudWatch charges ingestion on, per log group. Averaged
 * over the last 7 full days that carry data. Returns null when the metric is
 * unreadable (no cloudwatch:GetMetricData permission) or empty, so the caller
 * falls back to the storedBytes estimate.
 */
export declare function incomingBytesDailyAverage(groupNames: string[], region: string, now?: number, client?: {
    send: (cmd: GetMetricDataCommand) => Promise<{
        MetricDataResults?: Array<{
            Values?: number[];
        }>;
    }>;
}): Promise<{
    dailyBytes: number;
    days: number;
} | null>;
export declare const cloudwatchConnector: SiemConnector;