export declare const LIFECYCLE_TERMINAL_STATES: readonly ["ready", "failed", "cancelled"];
export declare const LIFECYCLE_NON_TERMINAL_STATES: readonly ["pending", "provisioning", "migrating", "retiring"];
export declare const LIFECYCLE_STATES: readonly ["pending", "provisioning", "migrating", "retiring", "ready", "failed", "cancelled"];
export declare const LIFECYCLE_MIGRATION_STATES: readonly ["pending", "migrated", "failed"];
export declare const LIFECYCLE_OPERATIONS: readonly ["ensure_database", "migrate_schema", "retire_database"];
export declare const LIFECYCLE_ENVIRONMENTS: readonly ["edit", "preview", "deployed"];
export declare const DATABASE_ENGINES: readonly ["postgres", "snowflake", "snowflake_postgres", "lakebase"];
export declare const DATABASE_LIFECYCLE_MANAGED_BY = "database_lifecycle";
export declare const NATIVE_DB_AUTH_DESCRIPTOR_VERSION: 2;
export declare const NATIVE_DB_AUTH_DESCRIPTOR_VERSIONS: readonly [1, 2];
export declare const NATIVE_DB_CONNECTOR_ROLE_NAME_PREFIX = "superblocks-native-db-connector";
export declare const NATIVE_DB_IAM_AUTH_MODE: "aws_iam_role";
export declare const NATIVE_DB_IDENTIFIER_HASH_DOMAIN = "superblocks-native-db:v1";
export declare const DATABASE_LIFECYCLE_CAPABILITY_MANAGED_IAM_V1 = "managed-IAM-v1";
export declare const DATABASE_LIFECYCLE_TAG_OPERATIONS = "databaseLifecycle:operations";
export declare const DATABASE_LIFECYCLE_TAG_ENGINES = "databaseLifecycle:engines";
export declare const DATABASE_LIFECYCLE_TAG_ENVIRONMENT_PROFILES = "databaseLifecycle:environmentProfiles";
export declare const DATABASE_LIFECYCLE_TAG_CAPABILITIES = "databaseLifecycle:capabilities";
export type LifecycleEnvironment = (typeof LIFECYCLE_ENVIRONMENTS)[number];
export type DatabaseEngine = (typeof DATABASE_ENGINES)[number];
export type LifecycleOperation = (typeof LIFECYCLE_OPERATIONS)[number];
export type LifecycleTerminalState = (typeof LIFECYCLE_TERMINAL_STATES)[number];
export type LifecycleNonTerminalState = (typeof LIFECYCLE_NON_TERMINAL_STATES)[number];
export type LifecycleState = (typeof LIFECYCLE_STATES)[number];
export type LifecycleMigrationState = (typeof LIFECYCLE_MIGRATION_STATES)[number];
export type LifecycleErrorCode = 'unsupported_provider_capability' | 'backend_locked' | 'policy_blocked' | 'credential_resolution_failed' | 'terraform_failed' | 'migration_failed' | 'callback_failed' | 'stale_dispatch';
export declare const CREDENTIAL_RESOLVERS: readonly ["opa_local", "aws_secrets_manager", "gcp_secret_manager", "vault", "kubernetes_secret"];
export type CredentialResolver = (typeof CREDENTIAL_RESOLVERS)[number];
export type CredentialRef = {
    resolver: CredentialResolver;
    ref: string;
    field?: string;
};
export type NativeDbIamDescriptor = {
    application_id: string;
    auth_descriptor_version: (typeof NATIVE_DB_AUTH_DESCRIPTOR_VERSIONS)[number];
    auth_mode: typeof NATIVE_DB_IAM_AUTH_MODE;
    aws_account_id: string;
    binding_id: string;
    cluster_resource_id: string;
    connector_role_arn: string;
    database: string;
    host: string;
    port: number;
    region: string;
    username: string;
};
export type DatabaseRequirement = {
    logicalName: string;
    engine: DatabaseEngine;
    version?: string;
    sizing?: Record<string, unknown>;
    extensions?: readonly string[];
    replicaCount?: number;
    migrationDirectory?: string;
};
type DatabaseBindingBase = {
    id: string;
    bindingKey: string;
    requirementKey: string;
    logicalName: string;
    applicationId: string;
    environment: LifecycleEnvironment;
    profile: string;
    desiredSpecHash: string;
    migrationState: LifecycleMigrationState;
};
export type ReadyDatabaseBinding = DatabaseBindingBase & {
    lifecycleState: 'ready';
    connectionMetadata: Record<string, string | number | boolean>;
    credentialRefs: Record<string, CredentialRef>;
};
export type IncompleteDatabaseBinding = DatabaseBindingBase & {
    lifecycleState: Exclude<LifecycleState, 'ready'>;
    connectionMetadata?: Record<string, string | number | boolean>;
    credentialRefs?: Record<string, CredentialRef>;
};
export type DatabaseBinding = ReadyDatabaseBinding | IncompleteDatabaseBinding;
export declare function isReadyDatabaseBinding(binding: DatabaseBinding): binding is ReadyDatabaseBinding;
export type LifecycleRequest = {
    id: string;
    operation: LifecycleOperation;
    bindingKey: string;
    requirementKey: string;
    desiredSpecHash: string;
    state: LifecycleState;
};
export declare const PHYSICAL_DATABASE_INSTANCE_STATUSES: readonly ["active", "draining", "retired"];
export type PhysicalDatabaseInstanceStatus = (typeof PHYSICAL_DATABASE_INSTANCE_STATUSES)[number];
export type PhysicalDatabaseInstance = {
    id: string;
    organizationId: string;
    region: string;
    environment: LifecycleEnvironment;
    engine: DatabaseEngine;
    endpoint: string;
    masterCredentialRef: CredentialRef;
    capacityMax: number;
    capacityUsed: number;
    status: PhysicalDatabaseInstanceStatus;
    metadata: Record<string, unknown>;
    created?: Date;
    updated?: Date;
};
export type LifecycleMigration = {
    version: string;
    filename: string;
    sql: string;
};
export type LifecycleDispatchContinuation = {
    currentState?: string;
    physicalInstanceId?: string;
    physicalTerraformResourceKey?: string;
    reservationId?: string;
};
export type LifecycleDispatchPayload = {
    applicationId: string;
    bindingId: string;
    bindingKey: string;
    connectionMetadata?: Record<string, string | number | boolean>;
    continuation?: LifecycleDispatchContinuation;
    desiredSpec: DatabaseRequirement;
    desiredSpecHash: string;
    environment: LifecycleEnvironment;
    migrations?: LifecycleMigration[];
    operation: LifecycleOperation;
    profile: string;
    requestId: string;
    resourceKey: string;
    runtimeCredentialRefs?: Record<string, CredentialRef>;
    migrationCredentialRefs?: Record<string, CredentialRef>;
};
export declare function computeRequirementKey(requirement: Pick<DatabaseRequirement, 'logicalName' | 'engine'>): string;
export declare function computeBindingKey(input: {
    organizationId: string;
    applicationId: string;
    environment: LifecycleEnvironment;
    profile: string;
}): string;
export declare function computeLegacyBindingKeyWithoutOrganization(input: {
    applicationId: string;
    environment: LifecycleEnvironment;
    profile: string;
}): string;
export declare function computeDesiredSpecHash(requirement: DatabaseRequirement): Promise<string>;
export declare function nativeDbIamSessionPolicy(descriptor: NativeDbIamDescriptor): string;
export declare function parseNativeDbIamDescriptor(value: unknown): NativeDbIamDescriptor | undefined;
export declare function computeNativeDbApplicationToken(trustedApplicationId: string): Promise<string>;
export declare function computeNativeDbBindingToken(trustedBindingId: string): Promise<string>;
export declare function computeNativeDbDatabaseName(deploymentToken: string, trustedDatabaseId: string): Promise<string>;
export declare function computeResourceKey(input: {
    organizationId: string;
    applicationId: string;
    requirementKey: string;
    environment: LifecycleEnvironment;
    profile: string;
    actorScope?: string;
}): string;
export declare function isTerminalLifecycleState(state: LifecycleState): state is LifecycleTerminalState;
export declare function redactLifecycleSecrets<T>(value: T): T;
export declare const SECRET_KEY_PATTERN: RegExp;
export declare const CREDENTIAL_BEARING_DSN_SCHEMES: readonly ["postgres", "postgresql", "mysql", "mariadb", "mongodb", "mongodb+srv", "redis", "rediss", "amqp", "amqps", "kafka"];
export declare function isSecretKey(key: string): boolean;
export declare function containsCredentialMaterial(value: string): boolean;
export {};
//# sourceMappingURL=index.d.ts.map