/**
 * Class 1 drift classification — out-of-band deletion suspects.
 *
 * A resource CloudFormation still tracks but which was deleted outside
 * CloudFormation wedges every subsequent update: the service handler returns
 * NotFound and the stack rolls back (the BusinessContinuity CMK incident). The
 * patterns here are derived from the Phase 0 empirical fixtures
 * (`fjall/deploy-core/src/orchestration/drift/__tests__/
 * fixtures/bc-stack-events.json`, captured 2026-07-07): the stable anchors are
 * the registry handler contract marker `HandlerErrorCode: NotFound` and the
 * service message shape `does not exist (Service: …`.
 *
 * Classification is SUSPECTS ONLY — never a confirmed verdict. Confirmation
 * requires a direct per-type probe (deploy-core `driftProbe.ts`); a suspect
 * that cannot be probed stays UNCONFIRMED and remediation is refused
 * (fail-closed: never surgery on a resource not proven dead).
 */
import type { ResourceEvent } from "./cloudformationTypes.js";
/**
 * A resource whose failure event carries the out-of-band-deletion shape.
 * `statusReason` is raw here — the analyser's `maskFailureAnalysis` boundary
 * (or the sink) masks before display/persistence.
 */
export interface DriftSuspectEvent {
    logicalId: string;
    resourceType: string;
    physicalId?: string;
    /** The failed status that carried the NotFound shape (e.g. UPDATE_FAILED). */
    failedStatus: string;
    statusReason: string;
}
/** True when a failure reason carries the out-of-band-deletion shape. */
export declare function isDriftSuspectReason(statusReason: string): boolean;
/**
 * True for the stack-level event that opens a CloudFormation operation —
 * the shared boundary for "current operation only" scans (the deploy-core
 * last-operation event walk and the failure analyser's drift scan).
 */
export declare function isOperationOpeningEvent(event: ResourceEvent, stackName: string): boolean;
/**
 * Timestamp of the most recent operation-opening event for `stackName`, or
 * null when none is visible. Server-clock consistent with event timestamps,
 * so callers can bound scans without local-clock skew.
 */
export declare function findCurrentOperationStart(events: readonly ResourceEvent[], stackName: string): Date | null;
/**
 * Extract out-of-band-deletion suspects from failure events. Callers pass
 * EVERY failed event in the operation, not just each resource's latest — a
 * wedged resource's UPDATE_FAILED is typically superseded by a later
 * UPDATE_ROLLBACK_* event, so latest-event-per-resource semantics would drop
 * exactly the suspects this classifier exists to find. Deduplicated by
 * logicalId (first match wins).
 */
export declare function classifyDriftSuspectEvents(events: readonly ResourceEvent[]): DriftSuspectEvent[];