import { type IAMClient } from "@aws-sdk/client-iam";
import { type Result } from "@fjall/generator";
import type { DeployCallbacks } from "../../types/callbacks.js";
export interface OidcProviderTeardownResult {
    deleted: boolean;
    reason: string;
}
/**
 * Reference-counted teardown of the account-global `https://fjall.io` OIDC
 * provider. The provider is an IAM singleton shared by every Fjall deploy role
 * in the account and is now Retain-on-stack-delete (adopt-if-exists), so the
 * only safe deleter is one that confirms NOTHING still federates it.
 *
 * Deletes only when (a) the provider exists and (b) no IAM role's trust policy
 * references its ARN. ListRoles returns the URL-encoded
 * AssumeRolePolicyDocument inline, so a single paginated sweep answers the
 * reference count without a GetRole per role. Any surviving reference — a
 * surviving connect/account stack's deploy role — short-circuits to a no-op.
 *
 * Failure messages stay raw — callers mask at their output boundary.
 */
export declare function deleteOidcProviderIfUnreferenced(client: IAMClient, abortSignal?: AbortSignal): Promise<Result<OidcProviderTeardownResult>>;
export interface OidcProviderEnsureResult {
    status: "present" | "recreated" | "aborted";
    providerArn?: string;
}
/**
 * Adopt-or-create guard for the account-global `https://fjall.io` OIDC
 * provider, run after an Account/Platform stack deploy completes.
 *
 * Why this exists: pre-2.20.0 Account stacks owned the provider through CDK's
 * L2 `iam.OpenIdConnectProvider` custom resource. The first redeploy on
 * ≥2.20.0 replaces it with the adopt-or-create `Custom::FjallOidcProvider`
 * resource under a NEW logical ID, so CloudFormation creates the new resource
 * (which adopts the existing provider) and then — in the cleanup phase, after
 * every in-template resource has run — deletes the old L2 resource, whose
 * handler issues a real DeleteOpenIDConnectProvider on the same physical
 * provider. The update completes green while the account's web-identity trust
 * anchor is destroyed: every subsequent scan AND OIDC-authenticated deploy
 * fails with InvalidIdentityToken (2026-07-07 fjall-org incident). Because
 * cleanup runs last, no in-template fix can win; this reconcile runs after
 * CloudFormation returns, inside the same deploy session, so the account is
 * healed before the deploy that broke it reports success.
 *
 * The created provider mirrors the OidcConnector handler byte-for-byte via
 * the shared `@fjall/generator` spec constants. EntityAlreadyExists from a
 * concurrent creator (parallel cascade region, Quick-Create) is success.
 *
 * Failure messages stay raw — callers mask at their output boundary.
 */
export declare function ensureOidcProviderPresent(client: IAMClient, abortSignal?: AbortSignal): Promise<Result<OidcProviderEnsureResult>>;
/**
 * Best-effort wrapper around {@link ensureOidcProviderPresent}: surfaces the
 * outcome via callbacks/logger and never fails the deploy — the stack deploy
 * itself succeeded, and a reconcile miss must not convert that into a failure.
 * A recreation is reported at warn level because it means the deletion class
 * fired and the operator should know the trust anchor was briefly absent.
 */
export declare function reconcileOidcProviderAfterDeploy(client: IAMClient, callbacks: DeployCallbacks, abortSignal?: AbortSignal): Promise<void>;
/**
 * Best-effort wrapper around {@link deleteOidcProviderIfUnreferenced}: surfaces
 * the outcome via callbacks/logger and swallows failures. A cleanup miss leaves
 * a harmless orphaned provider and must never block a teardown.
 */
export declare function cleanupOrphanedOidcProvider(client: IAMClient, callbacks: DeployCallbacks, abortSignal?: AbortSignal): Promise<void>;