import { type S3Client } from "@aws-sdk/client-s3";
import { type CloudTrailClient } from "@aws-sdk/client-cloudtrail";
import { type Result } from "@fjall/generator";
export interface OrgTrailAccountDelivery {
    accountId: string;
    /** At least one log object observed in the recency window's date partitions. */
    delivered: boolean;
    /**
     * An observed object falls inside the recency window. `undefined` when the
     * facts could not be determined: region discovery was truncated or over the
     * cap, or a window partition exhausted its page cap before recency was
     * proven. The reconciler treats `undefined` as "do not advance", never as
     * verified.
     */
    recentDelivery: boolean | undefined;
    latestObjectAt?: Date;
}
export interface OrgTrailDeliveryReport {
    bucketName: string;
    perAccount: OrgTrailAccountDelivery[];
}
/**
 * Verify per-member delivery into the organisation trail bucket under the
 * management account. Region prefixes are discovered with one delimiter
 * listing of AWSLogs/<orgId>/<accountId>/CloudTrail/, then only the date
 * partitions covering the recency window are scanned. Read-only; a
 * NoSuchBucket failure means the org trail has not deployed yet.
 */
export declare function verifyOrgTrailDelivery(s3Client: S3Client, options: {
    bucketName: string;
    orgId: string;
    accountIds: string[];
    recencyWindowMs?: number;
    abortSignal?: AbortSignal;
}): Promise<Result<OrgTrailDeliveryReport>>;
export interface TrailLoggingStatus {
    isLogging: boolean;
    latestDeliveryTime?: Date;
}
/**
 * Reverse-path primitive: before leaving the organisation trail (org →
 * account), the recreated per-account trail must be confirmed logging.
 */
export declare function getTrailLoggingStatus(cloudTrailClient: CloudTrailClient, trailName: string, abortSignal?: AbortSignal): Promise<Result<TrailLoggingStatus>>;