import { z } from "zod";
/**
 * Fixed name of the disaster-recovery backup vault. Single source of truth for
 * the @fjall/components-infrastructure DisasterRecovery construct (which
 * creates the vault under this name) and deploy-core's ownership and survival
 * probes (which look it up by the same name).
 */
export declare const BACKUP_VAULT_NAME = "backupVault";
/**
 * CDK context key the deploy engine injects the backup-vault ownership verdict
 * under (`-c fjallBackupVault=<json>`), read by `readBackupVaultVerdict` in
 * @fjall/components-infrastructure (`utils/cdkContext.ts`). One JSON value,
 * not a boolean: the construct needs the live key ARN (a create-only vault
 * property) to declare a re-owned vault without replacing it, and the live
 * lock to report it and warn when the configured intent differs.
 */
export declare const BACKUP_VAULT_CONTEXT_KEY = "fjallBackupVault";
/**
 * The live vault lock as `DescribeBackupVault` reports it. `lockDate` is the
 * instant a compliance-mode lock became (or becomes) immutable; a governance
 * lock carries none. Every field is optional: a lock put through the Backup
 * API may carry a maximum without a minimum, or a lock date alone, so a
 * locked vault can report none of them. The lock is never declared in a
 * template — the construct reads it for the `VaultLockEnabled` output and the
 * intent warning only.
 */
export declare const BackupVaultLockSchema: z.ZodObject<{
    minRetentionDays: z.ZodOptional<z.ZodNumber>;
    maxRetentionDays: z.ZodOptional<z.ZodNumber>;
    lockDate: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
export type BackupVaultLock = z.infer<typeof BackupVaultLockSchema>;
/**
 * Ownership verdict for the fixed-name DR vault in one account/region, probed
 * by the deploy engine before synth (`probeBackupVaultOwnership` in
 * deploy-core):
 *
 * - `absent` — no vault; the construct creates it with a stack-managed key.
 * - `owned` — an `AWS::Backup::BackupVault` with physical id
 *   `backupVault` is a current resource of THIS account stack. `keyInStack`
 *   says whether its KMS key is too: if so the template is the create
 *   template (the vault keeps converging to intent); if not the key is a
 *   retained survivor and the vault is re-owned — declared against the live
 *   key, with no lock declared (Fjall never issues a lock call against a
 *   vault it did not create; the live lock stays as it is).
 * - `unowned` — the vault exists but is not in the stack: the import
 *   candidate. The construct declares identity only and the engine deploys
 *   with `--import-existing-resources`, then re-probes and converges.
 *
 * `keyArn` is always a customer-managed key: the probe refuses a vault on an
 * AWS-owned or AWS-managed key before any verdict is issued, because the
 * re-owned template aliases the key and the DR plans' cross-account copies
 * need a customer-managed one. A vault owned by ANOTHER stack is not
 * distinguished here: the import change set fails with CloudFormation's own
 * "already belongs to another stack".
 */
export declare const BackupVaultVerdictSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
    state: z.ZodLiteral<"absent">;
}, z.core.$strict>, z.ZodObject<{
    state: z.ZodLiteral<"owned">;
    keyArn: z.ZodString;
    keyInStack: z.ZodBoolean;
    lock: z.ZodNullable<z.ZodObject<{
        minRetentionDays: z.ZodOptional<z.ZodNumber>;
        maxRetentionDays: z.ZodOptional<z.ZodNumber>;
        lockDate: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>>;
}, z.core.$strict>, z.ZodObject<{
    state: z.ZodLiteral<"unowned">;
    keyArn: z.ZodString;
    lock: z.ZodNullable<z.ZodObject<{
        minRetentionDays: z.ZodOptional<z.ZodNumber>;
        maxRetentionDays: z.ZodOptional<z.ZodNumber>;
        lockDate: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>>;
}, z.core.$strict>], "state">;
export type BackupVaultVerdict = z.infer<typeof BackupVaultVerdictSchema>;
/**
 * Whether a verdict selects the re-owned template: the vault is (or is about
 * to be) a stack resource whose key lives outside the stack. Shared by the
 * construct (mode selection) and the engine (the import pass is the
 * `unowned` half of this).
 */
export declare function isReownedBackupVault(verdict: BackupVaultVerdict): boolean;