export declare const LIFECYCLE_TERMINAL_STATES: readonly ["ready", "failed", "cancelled"];
export declare const LIFECYCLE_NON_TERMINAL_STATES: readonly ["pending", "provisioning", "migrating", "retiring"];
export declare const LIFECYCLE_STATES: readonly ["pending", "provisioning", "migrating", "retiring", "ready", "failed", "cancelled"];
export declare const LIFECYCLE_MIGRATION_STATES: readonly ["pending", "migrated", "failed"];
export declare const LIFECYCLE_OPERATIONS: readonly ["ensure_dev_database", "ensure_prod_database", "migrate_schema", "retire_database"];
export declare const ENVIRONMENT_CLASSES: readonly ["dev", "staging", "prod"];
export declare const DATABASE_ENGINES: readonly ["postgres", "snowflake", "snowflake_postgres", "lakebase"];
export declare const DATABASE_LIFECYCLE_MANAGED_BY = "database_lifecycle";
export type EnvironmentClass = (typeof ENVIRONMENT_CLASSES)[number];
export type DatabaseEngine = (typeof DATABASE_ENGINES)[number];
export type LifecycleOperation = (typeof LIFECYCLE_OPERATIONS)[number];
export type LifecycleTerminalState = (typeof LIFECYCLE_TERMINAL_STATES)[number];
export type LifecycleNonTerminalState = (typeof LIFECYCLE_NON_TERMINAL_STATES)[number];
export type LifecycleState = (typeof LIFECYCLE_STATES)[number];
export type LifecycleMigrationState = (typeof LIFECYCLE_MIGRATION_STATES)[number];
export type LifecycleErrorCode = 'unsupported_provider_capability' | 'backend_locked' | 'policy_blocked' | 'credential_resolution_failed' | 'terraform_failed' | 'callback_failed';
export declare const CREDENTIAL_RESOLVERS: readonly ["opa_local", "aws_secrets_manager", "gcp_secret_manager", "vault", "kubernetes_secret"];
export type CredentialResolver = (typeof CREDENTIAL_RESOLVERS)[number];
export type CredentialRef = {
    resolver: CredentialResolver;
    ref: string;
    field?: string;
};
export type DatabaseRequirement = {
    logicalName: string;
    engine: DatabaseEngine;
    version?: string;
    sizing?: Record<string, unknown>;
    extensions?: readonly string[];
    replicaCount?: number;
    migrationDirectory?: string;
};
export type TerraformDatabaseBackend = {
    provisioner: 'terraform';
    provider: 'aws-rds' | 'snowflake' | 'databricks';
    stateBackend: 's3' | 'gcs' | 'azurerm' | 'local';
    remoteState: boolean;
    locking: boolean;
};
export type DatabaseBackend = TerraformDatabaseBackend;
export type EnvironmentProfile = {
    id: string;
    organizationId: string;
    environmentClass: EnvironmentClass;
    environmentName: string;
    opaAgentId: string;
    supportedOperations: LifecycleOperation[];
    supportedEngines: DatabaseEngine[];
    backend: DatabaseBackend;
};
type DatabaseBindingBase = {
    id: string;
    bindingKey: string;
    requirementKey: string;
    logicalName: string;
    applicationId: string;
    environmentClass: EnvironmentClass;
    environmentName: string;
    desiredSpecHash: string;
    migrationState: LifecycleMigrationState;
};
export type ReadyDatabaseBinding = DatabaseBindingBase & {
    lifecycleState: 'ready';
    connectionMetadata: Record<string, string | number | boolean>;
    credentialRefs: Record<string, CredentialRef>;
};
export type IncompleteDatabaseBinding = DatabaseBindingBase & {
    lifecycleState: Exclude<LifecycleState, 'ready'>;
    connectionMetadata?: Record<string, string | number | boolean>;
    credentialRefs?: Record<string, CredentialRef>;
};
export type DatabaseBinding = ReadyDatabaseBinding | IncompleteDatabaseBinding;
export declare function isReadyDatabaseBinding(binding: DatabaseBinding): binding is ReadyDatabaseBinding;
export type LifecycleRequest = {
    id: string;
    operation: LifecycleOperation;
    bindingKey: string;
    requirementKey: string;
    desiredSpecHash: string;
    state: LifecycleState;
};
export type TerraformModuleInput = {
    bindingKey: string;
    requirement: DatabaseRequirement;
    credentialRefs: Record<string, CredentialRef>;
    metadata: Record<string, string>;
};
export type TerraformModuleOutput = {
    connection: Record<string, string | number | boolean>;
    credentialRefs: Record<string, CredentialRef>;
    resourceKey: string;
};
export declare function computeRequirementKey(requirement: Pick<DatabaseRequirement, 'logicalName' | 'engine'>): string;
export declare function computeBindingKey(input: {
    organizationId: string;
    applicationId: string;
    environmentClass: EnvironmentClass;
    environmentName: string;
    requirementKey: string;
}): string;
export declare function computeLegacyBindingKeyWithoutOrganization(input: {
    applicationId: string;
    environmentClass: EnvironmentClass;
    environmentName: string;
    requirementKey: string;
}): string;
export declare function computeDesiredSpecHash(requirement: DatabaseRequirement): Promise<string>;
export declare function isTerminalLifecycleState(state: LifecycleState): state is LifecycleTerminalState;
export declare function redactLifecycleSecrets<T>(value: T): T;
export declare const SECRET_KEY_PATTERN: RegExp;
export declare const CREDENTIAL_BEARING_DSN_SCHEMES: readonly ["postgres", "postgresql", "mysql", "mariadb", "mongodb", "mongodb+srv", "redis", "rediss", "amqp", "amqps", "kafka"];
export declare function isSecretKey(key: string): boolean;
export declare function containsCredentialMaterial(value: string): boolean;
export {};
//# sourceMappingURL=index.d.ts.map