import { type ResourcePolicyStatement } from "@fjall/generator";
import { type RawPolicyStatement } from "./bucketPolicyTriage.js";
export interface ConvertedResourcePolicy {
    /** Kept statements that the typed `ResourcePolicyStatement` carries faithfully. */
    statements: ResourcePolicyStatement[];
    /**
     * Kept statements outside the typed shape (NotPrincipal/NotAction/NotResource,
     * a Service/Federated/CanonicalUser principal, a non-string condition operand,
     * an absent Resource). The caller MUST degrade the IaC reconcile to report-only
     * when this is non-empty — a partial typed array would clobber these on deploy.
     */
    unconvertible: RawPolicyStatement[];
}
/**
 * Split the triage's kept statements into those representable as typed
 * `ResourcePolicyStatement`s and those that are not. The enforceSSL TLS-only
 * deny is excluded from BOTH — the construct always re-adds it via
 * `enforceSSL: true`, so listing it would double-render.
 */
export declare function toResourcePolicyStatements(keptStatements: RawPolicyStatement[]): ConvertedResourcePolicy;