import { type STSClient } from "@aws-sdk/client-sts";
import { type Result } from "@fjall/generator";
import type { AwsProviderCredentials } from "../AwsProvider.js";
/**
 * The five AWS-managed root-task policies AssumeRoot accepts. Every root
 * session is bounded by exactly one of these; arbitrary policies are
 * rejected by STS, so the primitive rejects them before sending.
 */
export declare const ROOT_TASK_POLICY_ARNS: readonly ["arn:aws:iam::aws:policy/root-task/IAMAuditRootUserCredentials", "arn:aws:iam::aws:policy/root-task/IAMCreateRootUserPassword", "arn:aws:iam::aws:policy/root-task/IAMDeleteRootUserCredentials", "arn:aws:iam::aws:policy/root-task/S3UnlockBucketPolicy", "arn:aws:iam::aws:policy/root-task/SQSUnlockQueuePolicy"];
export type RootTaskPolicyArn = (typeof ROOT_TASK_POLICY_ARNS)[number];
export declare function isRootTaskPolicyArn(value: string): value is RootTaskPolicyArn;
/** AssumeRoot hard maximum session duration. */
export declare const MAX_ROOT_SESSION_SECONDS = 900;
export interface AssumeRootOptions {
    /** Member account whose root principal the session acts as. */
    targetAccountId: string;
    /** One of the five AWS root-task policy ARNs bounding the session. */
    taskPolicyArn: string;
    /** Session duration in seconds, max 900. Omitted → AWS default (900). */
    durationSeconds?: number;
    /** Caller shutdown signal, composed with the per-call SDK timeout. */
    abortSignal?: AbortSignal;
}
export interface RootTaskSession {
    credentials: AwsProviderCredentials & {
        expiration?: Date;
    };
    /** Identity STS records for the root session (CloudTrail audit trail). */
    sourceIdentity?: string;
}
/**
 * Assume a member account's root principal for a bounded privileged task
 * via STS AssumeRoot.
 *
 * Requires management-account or delegated-admin credentials with
 * `sts:AssumeRoot`, centralised root access enabled on the organisation
 * (RootCredentialsManagement), and a client pinned to a regional STS
 * endpoint — AssumeRoot is not served by the global endpoint. The cascade
 * role path (`assumeCascadeRole`) is structurally useless against a
 * quarantine: a quarantine deny policy blocks every role principal, while
 * an assume-root session bypasses member roles entirely.
 *
 * Returned credentials are credential VALUES — callers must never log
 * them; error messages from this primitive are masked.
 */
export declare function assumeRootForTask(client: STSClient, options: AssumeRootOptions): Promise<Result<RootTaskSession>>;