import { type S3Client } from "@aws-sdk/client-s3";
import type { DeployCallbacks } from "../../types/callbacks.js";
/**
 * Tag keys that opt a stack bucket into SDK-side pre-emptying before CFN
 * destroy. `aws-cdk:auto-delete-objects` covers stacks deployed while the S3
 * wrapper still used the CDK custom resource — an external CDK contract, so
 * it stays a literal here; `SDK_PRE_EMPTY_TAG_KEY` is the marker the Phase 3
 * wrapper applies after autoDeleteObjects retirement (canonical source:
 * @fjall/util/aws infraTags, shared with the producing S3 wrapper).
 * A bucket carrying neither tag (Retain) is never touched — ListStackResources
 * cannot read removal policy, so this predicate is the Retain-skip mechanism.
 * A tag only counts when its value is "true", mirroring the CDK auto-delete
 * handler's own check: flipping the value is the documented opt-out for
 * preserving data, and this pass must never be looser than the handler.
 */
export declare const PRE_EMPTY_TAG_KEYS: readonly ["aws-cdk:auto-delete-objects", "fjall:sdk-pre-empty"];
/**
 * Error names meaning the bucket is already gone — convergence, not failure,
 * for delete-side S3 calls. Shared with the trail-migration decommission
 * (coupled values: a new gone-shape must be recognised by both sites).
 */
export declare const BUCKET_GONE_ERROR_NAMES: ReadonlySet<string>;
/**
 * Gone-class predicate for delete-side S3 calls: error name in
 * BUCKET_GONE_ERROR_NAMES, with a message fallback because wrapped/unmodelled
 * errors can carry the shape only in the message. NoSuchBucket is the one
 * safe message probe — "NotFound"/"404" are too generic to match free text.
 */
export declare function isBucketGoneError(error: unknown): boolean;
/**
 * Outcome of an empty pass. "access-denied" is the quarantine signal
 * `cleanupFailedStack` classifies; existing callers ignore the value and keep
 * their warn-only behaviour.
 */
export type EmptyBucketOutcome = "emptied" | "missing" | "access-denied" | "failed";
/**
 * Empty an S3 bucket by deleting all object versions and delete markers.
 * Handles NoSuchBucket gracefully (bucket already gone).
 * Exported for the org-trail migration's member-bucket decommission.
 */
export declare function emptyS3Bucket(s3Client: S3Client, bucketName: string, callbacks?: DeployCallbacks, abortSignal?: AbortSignal): Promise<EmptyBucketOutcome>;
export type PreEmptyVerdict = "matched" | "retained" | "gone" | "unreadable";
/**
 * Classify a bucket for a destroy-intent pass via GetBucketTagging.
 * - "matched": carries a pre-empty tag — the bucket may be emptied/deleted.
 * - "retained": untagged (NoSuchTagSet / no matching tag) — never touched.
 * - "gone": NoSuchBucket — already deleted; excluded from the retained
 *   report because nothing survives the destroy.
 * - "unreadable": tags could not be read (throttle, denial) — never touched,
 *   already warned here; callers decide how to account for it (the pre-empty
 *   pass folds it into the conservative retained report, the orphan sweep
 *   counts it as a failure).
 */
export declare function classifyBucketForPreEmpty(s3Client: S3Client, bucketName: string, callbacks?: DeployCallbacks, abortSignal?: AbortSignal): Promise<PreEmptyVerdict>;