import { type S3Client } from "@aws-sdk/client-s3";
import { type Result } from "@fjall/generator";
import { type RawPolicyDocument } from "./bucketPolicyTriage.js";
export interface RestoreBucketPolicyInput {
    bucketName: string;
    /** The sane policy document to re-put, already serialised to JSON. */
    policyDocument: string;
    abortSignal?: AbortSignal;
}
export interface RestoreBucketPolicySuccess {
    outcome: "restored";
}
export interface RestoreBucketPolicyError {
    message: string;
    /**
     * True when the PutBucketPolicy was AccessDenied. The orchestration uses this
     * to fall back: the S3UnlockBucketPolicy root-task session is Get+Delete only,
     * so the first re-put attempt on it is expected to deny — the member-account
     * admin role regains S3 write once the lockout deny is gone and is retried.
     */
    isAccessDenied: boolean;
}
/**
 * Put `policyDocument` verbatim onto `bucketName` via the supplied S3 client.
 * The caller owns credential resolution (root session, then admin-role fallback);
 * this primitive only issues the single `PutBucketPolicy`. Errors are masked; an
 * AccessDenied is reported structurally so the caller can retry with a broader
 * role rather than re-parsing the message.
 */
export declare function restoreBucketPolicy(s3Client: S3Client, input: RestoreBucketPolicyInput): Promise<Result<RestoreBucketPolicySuccess, RestoreBucketPolicyError>>;
/**
 * A standalone enforceSSL-only policy document. Re-put when the triage's sane
 * document is null (the captured policy carried only the stranded lockout) so a
 * just-unlocked managed bucket is not left without TLS enforcement.
 */
export declare function synthesiseEnforceSslDocument(bucketName: string): string;
/**
 * Return `saneDoc` unchanged if it already carries an enforceSSL deny; otherwise
 * append one. A captured policy can keep legitimate grants yet have lost its
 * enforceSSL deny to out-of-band drift — re-putting without it would leave the
 * managed bucket TLS-unenforced.
 */
export declare function ensureEnforceSsl(saneDoc: RawPolicyDocument, bucketName: string): RawPolicyDocument;