import { type IAMClient } from "@aws-sdk/client-iam";
/**
 * Outcome of the deploy-boundary existence probe. Three-valued on purpose:
 * `absent` is proof (IAM answered NoSuchEntity); `unknown` is a read that
 * failed for any other reason — denied, throttled, network, aborted — and
 * MUST NOT be read as absence. `reason` is pre-masked at construction.
 */
export type DeployBoundaryProbe = {
    kind: "present";
    policyName: string;
    policyArn: string;
} | {
    kind: "absent";
    policyName: string;
    policyArn: string;
} | {
    kind: "unknown";
    policyName: string;
    policyArn: string;
    reason: string;
};
export interface DeployBoundaryProbeScope {
    /**
     * Partition of the session issuing the probe, from its own STS caller ARN
     * (`resolveCallerPartition`). Required, never defaulted — NoSuchEntity is
     * this probe's proof of absence, and the cost of a wrong partition at an
     * addressing seam is stated once, on `deployBoundaryPolicyArn`.
     */
    partition: string;
    /** The account whose CDK execution role this bootstrap creates or updates. */
    accountId: string;
    fjallOrgId: string;
    abortSignal?: AbortSignal;
}
/**
 * Probe whether the org's `FjallDeployBoundary${orgId}` managed policy exists
 * in the target account. `cdk bootstrap --custom-permissions-boundary` looks
 * the policy up by NAME and never verifies it — a missing policy fails the
 * CDKToolkit update instead of bootstrapping uncapped — so the flag must be
 * gated on this probe. IAM is global: a GetPolicy from any region answers.
 *
 * Never throws. Mirrors `describeAccountGlobalsExist`: NoSuchEntityException
 * is the only proof of absence; every other error is `unknown`.
 */
export declare function probeDeployBoundary(client: IAMClient, scope: DeployBoundaryProbeScope): Promise<DeployBoundaryProbe>;