import { type OrganizationsClient } from "@aws-sdk/client-organizations";
import { type Result } from "@fjall/generator";
/**
 * Canonical list of Organizations trusted-access service principals fjall
 * enables. Consumers MUST import this rather than redeclaring it — a mirror
 * list drifts silently when a principal is added here.
 */
export declare const SERVICE_PRINCIPALS: readonly ["account.amazonaws.com", "sso.amazonaws.com", "ipam.amazonaws.com", "ram.amazonaws.com", "backup.amazonaws.com", "member.org.stacksets.cloudformation.amazonaws.com", "guardduty.amazonaws.com", "securityhub.amazonaws.com", "config.amazonaws.com", "inspector2.amazonaws.com", "access-analyzer.amazonaws.com", "cloudtrail.amazonaws.com", "iam.amazonaws.com"];
/**
 * Enable AWS service access for all required service principals.
 * Idempotent — enabling an already-enabled principal is a no-op.
 */
export declare function enableServiceAccess(client: OrganizationsClient, abortSignal?: AbortSignal): Promise<Result<void>>;