import { type OrganizationsClient } from "@aws-sdk/client-organizations";
import { type Result } from "@fjall/generator";
import { type OrgDetails } from "./types.js";
/**
 * Ensure an AWS Organisation exists, creating one if necessary.
 * Idempotent — safe to call when the organisation already exists.
 */
export declare function ensureOrganisationExists(client: OrganizationsClient, abortSignal?: AbortSignal): Promise<Result<OrgDetails>>;
/**
 * Describe the current AWS Organisation, returning null if none exists.
 *
 * Read-only — never creates. With `tolerateAccessDenied`, an AccessDenied from
 * either DescribeOrganization or ListRoots also resolves to null: a standalone
 * account whose role lacks `organizations:*` is not in — and does not need — an
 * organisation, so a solo deploy proceeds standalone rather than failing. The
 * default (flag absent) still rethrows AccessDenied so the org/cascade paths
 * surface a genuine permissions error.
 */
export declare function describeOrganisation(client: OrganizationsClient, abortSignal?: AbortSignal, opts?: {
    tolerateAccessDenied?: boolean;
}): Promise<Result<OrgDetails | null>>;
/**
 * Org details visible to member-account credentials. rootId is present only
 * when the caller can ListRoots (management account or delegated
 * administrator).
 */
export interface MemberOrgDetails {
    orgId: string;
    managementAccountId: string;
    rootId?: string;
}
/**
 * Describe the organisation with credentials that may belong to a member
 * account. DescribeOrganization is callable from any account in an
 * organisation, but ListRoots only from the management account (or a
 * delegated administrator) — the root id resolves best-effort and is omitted
 * when credentials cannot list roots. Read-only: never creates. Returns null
 * when the account is not in an organisation. A DescribeOrganization denial
 * still fails: the caller needs orgId (the Account stack exports it), so a
 * silent fall-through would strip an exported output on redeploy.
 */
export declare function describeOrganisationAsMember(client: OrganizationsClient, abortSignal?: AbortSignal): Promise<Result<MemberOrgDetails | null>>;