import { type IAMClient } from "@aws-sdk/client-iam";
import { type Result } from "@fjall/generator";
export declare const ROOT_ACCESS_FEATURES: readonly ["RootCredentialsManagement", "RootSessions"];
export type RootAccessFeature = (typeof ROOT_ACCESS_FEATURES)[number];
export interface RootAccessEnablementSummary {
    /** Features newly enabled by this call. */
    enabled: RootAccessFeature[];
    /** Features that were already enabled before this call. */
    alreadyEnabled: RootAccessFeature[];
}
/**
 * Failure carrying the features that DID transition before the error, so the
 * orchestrator's warn gate (AC2.8) fires on partial enablement too. On
 * pre-flight (list) failures both arrays are empty — `alreadyEnabled` is
 * unknown, and only `enabled` is load-bearing for the warn gate.
 */
export declare class RootAccessEnablementError extends Error {
    readonly partialSummary: RootAccessEnablementSummary;
    constructor(message: string, partialSummary: RootAccessEnablementSummary);
}
/**
 * Enable centralised root access management for the organisation: root
 * credentials management plus root sessions, via the management account's
 * IAM client. Idempotent — features already enabled are skipped via the
 * ListOrganizationsFeatures pre-flight, so a re-run is a converging no-op.
 */
export declare function enableCentralisedRootAccess(client: IAMClient, abortSignal?: AbortSignal): Promise<Result<RootAccessEnablementSummary, RootAccessEnablementError>>;