/**
 * Forensics barrier for remediation surgery (drift-remediation plan § 3.2
 * phase 1, Q13). Persists the pre-mutation evidence — `GetTemplate(Original)`,
 * `DescribeStacks`, the last 50 stack events, and the drift-probe findings —
 * to `~/.fjall/forensics/remediation/<opId>/<capturedAt>/` BEFORE any
 * mutation. The capture-stamp segment scopes the bundle to ONE incarnation of
 * the opId (opId has no incarnation component): an archive-and-restart of the
 * same stack + logical-ID set captures into its OWN directory instead of
 * replacing the prior incarnation's evidence, so an archived done journal's
 * `forensicsPath` keeps resolving to the artefacts it recorded.
 *
 * Capture failure ABORTS the operation (the `onPolicyCaptured` precedent,
 * unlockBucket.ts): no capture → no mutate. Every artefact is masked before
 * persisting (boundary 4 — stack-event reasons and template bodies can embed
 * credential values) and written atomically (tmp + rename).
 *
 * Failure messages are pre-masked at construction — callers may surface them
 * to callback/log sinks directly.
 */
import { type Result } from "@fjall/generator";
import type { AwsProvider } from "../../aws/AwsProvider.js";
import type { DriftFinding } from "../../types/drift.js";
export interface ForensicsCaptureOptions {
    /** Override the forensics root — tests point this at a temp dir. */
    forensicsDir?: string;
    /** Injectable clock for the manifest timestamp. */
    now?: () => Date;
}
export declare function defaultRemediationForensicsDir(): string;
export interface CaptureRemediationForensicsParams {
    stackName: string;
    opId: string;
    /** The drift-probe evidence that motivated the surgery. */
    findings: readonly DriftFinding[];
    abortSignal?: AbortSignal;
}
export interface RemediationForensicsBundle {
    forensicsPath: string;
    files: string[];
    /** The raw live template body — reused by the flip derivation so the flip
     * provably derives from the same bytes the forensics preserved. */
    liveTemplateBody: string;
    /** The stack's current capabilities, echoed on the flip UpdateStack. */
    capabilities: string[];
    /** Live parameter keys — echoed UsePreviousValue on both flip CFN calls. */
    parameterKeys: string[];
    stackStatus: string;
}
export declare function captureRemediationForensics(aws: AwsProvider, params: CaptureRemediationForensicsParams, options?: ForensicsCaptureOptions): Promise<Result<RemediationForensicsBundle, Error>>;