import { type IdentitystoreClient } from "@aws-sdk/client-identitystore";
import { type SSOAdminClient } from "@aws-sdk/client-sso-admin";
import { type Result } from "@fjall/generator";
/**
 * Read-only Identity Centre snapshot for post-deploy consumers (the webapp
 * deployment worker persists it to map org members to AWS access by email).
 * Design: the 2026-07-04 organisation user-management design, § W6.
 */
export interface IdentityCentreSnapshotUser {
    userId: string;
    userName?: string;
    email?: string;
    displayName?: string;
}
export interface IdentityCentreSnapshotGroup {
    groupId: string;
    displayName?: string;
    description?: string;
    memberUserIds: string[];
}
export interface IdentityCentreSnapshot {
    instanceArn: string;
    identityStoreId: string;
    users: IdentityCentreSnapshotUser[];
    groups: IdentityCentreSnapshotGroup[];
    /** True when any listing stopped at the page budget — counts understate. */
    truncated: boolean;
}
export type IdentityCentreSnapshotResult = {
    status: "no-instance";
} | {
    status: "captured";
    snapshot: IdentityCentreSnapshot;
};
export interface IdentityCentreSnapshotOptions {
    abortSignal?: AbortSignal;
    /** Page budget per listing call family. Default: DEFAULT_MAX_PAGES in pagination.ts (~1000 items at 50/page). */
    maxPages?: number;
}
/**
 * Capture the live Identity Centre state: instance, users (with emails),
 * groups, and group memberships. All reads are paginated under a page budget
 * and abort-composed; truncation is reported, never silent. Zero instances is
 * a first-class outcome ("no-instance"), not an error — orgs without Identity
 * Centre enabled are expected.
 */
export declare function snapshotIdentityCentre(ssoAdminClient: SSOAdminClient, identitystoreClient: IdentitystoreClient, options?: IdentityCentreSnapshotOptions): Promise<Result<IdentityCentreSnapshotResult>>;