import { type STSClient } from "@aws-sdk/client-sts";
import { type Result } from "@fjall/generator";
import { type BucketPolicyTriage } from "./bucketPolicyTriage.js";
export interface RestoreAndReconcileInput {
    /** Member account holding the quarantined bucket. */
    accountId: string;
    bucketName: string;
    /** Bucket region — also pins the regional STS endpoint requirement. */
    region: string;
    /**
     * The infrastructure file contents, supplied when the bucket is known to map
     * to one. Absent → the reconcile is a no-op (the re-put still heals liveness).
     */
    infrastructureContent?: string;
    /** AST diagnostic path; defaults to the codemod's default when omitted. */
    infrastructureFilePath?: string;
    /**
     * Persist hook for the captured live policy — fired before the delete, after
     * capture. A rejection aborts the unlock (no delete). The callback receives
     * the captured policy UNMASKED (it can carry credential VALUES); the caller
     * MUST mask before persisting or displaying.
     */
    onPolicyCaptured?: (capturedPolicy: string) => Promise<void>;
    abortSignal?: AbortSignal;
}
export type ReconcileOutcome = {
    outcome: "nothing-to-change";
    reason: "no-infrastructure-content" | "no-statements-to-reconcile";
} | {
    outcome: "edit-ready";
    constructId: string;
    modifiedContent: string;
    addedStatements: number;
} | {
    outcome: "report-only";
    reason: "unresolved-construct" | "has-unconvertible" | "edit-failed";
    /** Whether the bucket maps to a managed `StorageFactory.build` construct. */
    managed: boolean;
    candidates?: string[];
    unconvertibleCount?: number;
    detail?: string;
};
export interface RestoreAndReconcileReport {
    unlock: "unlocked" | "no-policy";
    /**
     * The captured live policy, UNMASKED. The caller MUST mask it before
     * persisting or displaying — it can carry credential VALUES (e.g. a presigned
     * URL or connection string embedded in a Condition).
     */
    capturedPolicy: string | null;
    triage: BucketPolicyTriage | null;
    /** True when the re-put added an enforceSSL deny the captured policy lacked. */
    enforceSslSynthesised: boolean;
    restore: {
        outcome: "restored" | "skipped-empty";
        via?: "root" | "cascade";
    };
    reconcile: ReconcileOutcome;
}
/**
 * Unlock a quarantined bucket, restore a sane live policy, and reconcile the
 * durable IaC. Returns a structured report; never throws. The reconcile half
 * degrades to report-only rather than emitting a partial edit whenever the
 * construct cannot be located or a kept statement is unconvertible (a partial
 * typed array would be clobbered on the next deploy).
 */
export declare function restoreAndReconcileQuarantinedBucket(stsClient: STSClient, input: RestoreAndReconcileInput): Promise<Result<RestoreAndReconcileReport, Error>>;