/**
 * Bucket Provisioner — core provisioning logic.
 *
 * Orchestrates S3 bucket creation, privacy configuration, CORS setup,
 * versioning, and lifecycle rules. Uses the AWS SDK S3 client for all
 * operations, which works with any S3-compatible backend (MinIO, R2, etc.).
 *
 * Privacy model:
 * - Private/temp buckets: Block All Public Access, no bucket policy, presigned URLs only
 * - Public buckets: Block Public Access partially relaxed, public-read bucket policy applied
 */
import type { S3Client } from '@aws-sdk/client-s3';
import type { BucketPolicyDocument, PublicAccessBlockConfig } from './policies';
import type { BucketAccessType, CorsRule, CreateBucketOptions, LifecycleRule, ProvisionResult, StorageConnectionConfig, UpdateCorsOptions } from './types';
/**
 * Options for the BucketProvisioner constructor.
 */
export interface BucketProvisionerOptions {
    /** Storage connection config — credentials, endpoint, provider */
    connection: StorageConnectionConfig;
    /**
     * Default allowed origins for CORS rules.
     * These are the domains where your app runs (e.g., ["https://app.example.com"]).
     * Required for browser-based presigned URL uploads.
     */
    allowedOrigins: string[];
}
/**
 * The BucketProvisioner handles creating and configuring S3-compatible
 * buckets with the correct privacy settings, CORS rules, and policies
 * for the Constructive storage module.
 *
 * @example
 * ```typescript
 * const provisioner = new BucketProvisioner({
 *   connection: {
 *     provider: 'minio',
 *     region: 'us-east-1',
 *     endpoint: 'http://minio:9000',
 *     accessKeyId: 'minioadmin',
 *     secretAccessKey: 'minioadmin',
 *   },
 *   allowedOrigins: ['https://app.example.com'],
 * });
 *
 * // Provision a private bucket
 * const result = await provisioner.provision({
 *   bucketName: 'my-app-storage',
 *   accessType: 'private',
 * });
 * ```
 */
export declare class BucketProvisioner {
    private readonly client;
    private readonly config;
    private readonly allowedOrigins;
    constructor(options: BucketProvisionerOptions);
    /**
     * Get the underlying S3Client instance.
     * Useful for advanced operations not covered by the provisioner.
     */
    getClient(): S3Client;
    /**
     * Provision a fully configured S3 bucket.
     *
     * This is the main entry point. It:
     * 1. Creates the bucket (or verifies it exists)
     * 2. Configures Block Public Access based on access type
     * 3. Applies the appropriate bucket policy (public-read or none)
     * 4. Sets CORS rules for presigned URL uploads
     * 5. Optionally enables versioning
     * 6. Optionally adds lifecycle rules (auto-enabled for temp buckets)
     *
     * @param options - Bucket creation options
     * @returns ProvisionResult with all configuration details
     */
    provision(options: CreateBucketOptions): Promise<ProvisionResult>;
    /**
     * Create an S3 bucket. Handles the "bucket already exists" case gracefully.
     */
    createBucket(bucketName: string, region?: string): Promise<void>;
    /**
     * Check if a bucket exists and is accessible.
     */
    bucketExists(bucketName: string): Promise<boolean>;
    /**
     * Configure S3 Block Public Access settings.
     *
     * Gracefully skips if the S3-compatible backend (e.g. MinIO) does not
     * support PutPublicAccessBlock — the operation is best-effort since
     * not all providers implement this AWS-specific API.
     */
    setPublicAccessBlock(bucketName: string, config: PublicAccessBlockConfig): Promise<void>;
    /**
     * Apply an S3 bucket policy.
     *
     * Gracefully skips if the S3-compatible backend does not support
     * PutBucketPolicy — bucket policies are best-effort since not all
     * providers implement this AWS-specific API.
     */
    setBucketPolicy(bucketName: string, policy: BucketPolicyDocument): Promise<void>;
    /**
     * Delete an S3 bucket policy (used to clear leftover public policies).
     *
     * Gracefully handles backends that don't support this operation or have
     * no policy to delete.
     */
    deleteBucketPolicy(bucketName: string): Promise<void>;
    /**
     * Set CORS configuration on an S3 bucket.
     *
     * Gracefully skips if the S3-compatible backend (e.g. older MinIO) does
     * not support PutBucketCors — CORS is best-effort since not all providers
     * implement this API via the same endpoint path.
     */
    setCors(bucketName: string, rules: CorsRule[]): Promise<void>;
    /**
     * Enable versioning on an S3 bucket.
     *
     * Gracefully skips if the S3-compatible backend (e.g. MinIO edge-cicd)
     * does not support PutBucketVersioning — versioning is best-effort
     * since not all providers implement this API.
     */
    enableVersioning(bucketName: string): Promise<void>;
    /**
     * Set lifecycle rules on an S3 bucket.
     *
     * Gracefully skips if the S3-compatible backend (e.g. MinIO edge-cicd)
     * does not support PutBucketLifecycleConfiguration — lifecycle rules
     * are best-effort since not all providers implement this API.
     */
    setLifecycleRules(bucketName: string, rules: LifecycleRule[]): Promise<void>;
    /**
     * Update CORS configuration on an existing S3 bucket.
     *
     * Call this when the `allowed_origins` column changes on a bucket row.
     * Builds the appropriate CORS rule set for the bucket's access type
     * and applies it to the S3 bucket.
     *
     * @param options - Bucket name, access type, and new allowed origins
     * @returns The CORS rules that were applied
     */
    updateCors(options: UpdateCorsOptions): Promise<CorsRule[]>;
    /**
     * Inspect the current configuration of an existing bucket.
     *
     * Reads the bucket's policy, CORS, versioning, lifecycle, and public access
     * settings and returns them in a structured format. Useful for auditing
     * or verifying that a bucket is correctly configured.
     *
     * @param bucketName - S3 bucket name
     * @param accessType - Expected access type (used in the result)
     */
    inspect(bucketName: string, accessType: BucketAccessType): Promise<ProvisionResult>;
    private getPublicAccessBlock;
    private getBucketPolicy;
    private getBucketCors;
    private getBucketVersioning;
    private getBucketLifecycle;
}