import { type STSClient } from "@aws-sdk/client-sts";
import { type Result } from "@fjall/generator";
/**
 * The AWS partition the current session is operating in, read from its own
 * STS caller ARN.
 *
 * deploy-core addresses two account-global IAM resources by full ARN — the
 * `FjallDeployBoundary<orgId>` policy the seam-2 probe looks up and the
 * destroy sweep deletes — and an ARN cannot be built without a partition.
 * `GetCallerIdentity` is the right source: it is authoritative (the ARN
 * states the partition rather than implying it), it needs no IAM permission
 * so it cannot be denied, and every session that can deploy at all can answer
 * it. A region-prefix table would bucket an unrecognised region into `aws`
 * silently, and `DeploymentContext.callerIdentity` is `stubCallerIdentity`
 * (`Arn: ""`) on every orchestration path that reaches these two seams.
 *
 * Fails closed on a read failure or a malformed ARN — the message is
 * pre-masked at construction, so callers may surface it directly.
 */
export declare function resolveCallerPartition(client: STSClient, abortSignal?: AbortSignal): Promise<Result<string>>;