import type { STSClient } from "@aws-sdk/client-sts";
import { type Result } from "@fjall/generator";
export interface UnlockQueueInput {
    /** Member account holding the policy-locked queue. */
    accountId: string;
    queueName: string;
    /** Queue region — also pins the regional STS endpoint requirement. */
    region: string;
    abortSignal?: AbortSignal;
}
/**
 * "no-policy" means the queue carries no resource policy at all — it is not
 * policy-locked and there is nothing to unlock. Consumers phrase this
 * differently from a real unlock.
 */
export type UnlockQueueReport = {
    outcome: "unlocked";
    capturedPolicy: string;
    warning: string;
} | {
    outcome: "no-policy";
};
/**
 * Remove a stranded deny policy from a locked SQS queue via an STS
 * assume-root session bounded by the SQSUnlockQueuePolicy root-task policy.
 *
 * Ordering is load-bearing: the stranded policy is captured with
 * GetQueueAttributes BEFORE SetQueueAttributes clears it — the captured JSON
 * is the only forensic record of what the policy carried, and the operator
 * needs it to re-put legitimate statements. SQS has no DeleteQueuePolicy
 * API; setting Policy to the empty string is the documented removal path.
 *
 * The queue URL is composed deterministically from region/account/name
 * because GetQueueUrl is not in SQSUnlockQueuePolicy. This assumes the
 * standard aws partition URL shape (sqs.<region>.amazonaws.com) — GovCloud
 * and CN partitions are out of scope for the unlock engines.
 *
 * The STS client must use management-account or delegated-admin credentials
 * and carry an explicit region (assumeRootForTask enforces both). Session
 * credentials are credential VALUES — they exist only inside this function
 * and never reach a sink; error strings are masked.
 */
export declare function unlockQueue(stsClient: STSClient, input: UnlockQueueInput): Promise<Result<UnlockQueueReport>>;