import type { STSClient } from "@aws-sdk/client-sts";
import { type Result } from "@fjall/generator";
import { type RootTaskPolicyArn } from "../../aws/sts/assumeRoot.js";
export declare const S3_UNLOCK_POLICY_ARN: RootTaskPolicyArn;
export interface UnlockBucketInput {
    /** Member account holding the quarantined bucket. */
    accountId: string;
    bucketName: string;
    /** Bucket region — also pins the regional STS endpoint requirement. */
    region: string;
    /**
     * Fired AFTER the policy is captured (guaranteed non-empty) and BEFORE
     * DeleteBucketPolicy runs. A rejection ABORTS the unlock — the live policy is
     * left intact rather than deleted with no durable record of what it carried.
     * DeleteBucketPolicy does not log the document body to CloudTrail, so the
     * delete→re-put window is the only point a crash could lose the policy; this
     * barrier closes it. The callback receives the captured policy UNMASKED (it
     * can carry credential VALUES) — the consumer MUST mask before persisting.
     */
    onPolicyCaptured?: (capturedPolicy: string) => Promise<void>;
    abortSignal?: AbortSignal;
}
/**
 * "no-policy" means the bucket carries no policy at all — it is not
 * policy-locked and there is nothing to unlock. Consumers phrase this
 * differently from a real unlock.
 */
export type UnlockBucketReport = {
    outcome: "unlocked";
    capturedPolicy: string;
    warning: string;
} | {
    outcome: "no-policy";
};
/**
 * Remove a stranded deny policy from a quarantined bucket via an STS
 * assume-root session bounded by the S3UnlockBucketPolicy root-task policy.
 *
 * Ordering is load-bearing: the stranded policy is captured with
 * GetBucketPolicy BEFORE DeleteBucketPolicy destroys it — the captured JSON
 * is the only forensic record of what the policy carried, and the operator
 * needs it to re-put legitimate statements.
 *
 * The STS client must use management-account or delegated-admin credentials
 * and carry an explicit region (assumeRootForTask enforces both). Session
 * credentials are credential VALUES — they exist only inside this function
 * and never reach a sink; error strings are masked.
 */
export declare function unlockBucket(stsClient: STSClient, input: UnlockBucketInput): Promise<Result<UnlockBucketReport>>;