import { type IAMClient } from "@aws-sdk/client-iam";
import { type Result } from "@fjall/generator";
import type { OrgConfig } from "../../types/config/orgConfig.js";
export declare const ACCOUNT_GLOBALS_ROLE_NAME = "FjallMonitoring";
/**
 * Probe whether the fixed-name account globals exist in this account — the
 * prerequisite for a non-primary-region deploy, which skips creating them.
 * IAM is a global service, so a GetRole from any region answers it.
 *
 * The design-suggested OIDC provider is a confounded discriminator: the
 * connect-time quick-create stack creates it before any deploy (false
 * "exists"), and the account stack skips it under the fjallOidcConfigured /
 * receivesDeployRole() gates even when the globals branch runs.
 *
 * Returns success(false) ONLY on NoSuchEntityException. Every other error
 * (AccessDenied, throttling) propagates as failure — a mis-read "missing"
 * refuses a legitimate deploy, a mis-read "exists" silently deploys an
 * account that cannot work; neither may be guessed.
 *
 * Failure messages stay raw — callers mask at their output boundary.
 */
export declare function describeAccountGlobalsExist(client: IAMClient, abortSignal?: AbortSignal): Promise<Result<boolean>>;
/**
 * Org-vs-solo shape discriminator shared by every guard-step advisory in the
 * deploy flow (account globals, target readiness) — one drift here would
 * render contradictory remediation for the same estate.
 */
export declare function hasOrganisationTierAccount(providerAccounts: OrgConfig["providerAccounts"] | undefined): boolean;
/**
 * Deploy-primary-first advisory for a non-primary deploy whose primary-region
 * globals are missing (AC2a.2). Shape-branched on whether the provider
 * accounts carry a tier-organisation account: org estates remediate via the
 * cascade, solo accounts by deploying the primary region directly.
 */
export declare function buildMissingAccountGlobalsAdvisory(params: {
    target: string;
    deployRegion: string;
    primaryRegion: string;
    providerAccounts?: OrgConfig["providerAccounts"];
}): string;