import { type CloudFormationClient } from "@aws-sdk/client-cloudformation";
import { type EC2Client } from "@aws-sdk/client-ec2";
import { type Result } from "@fjall/generator";
import type { OrgConfig } from "../types/config/orgConfig.js";
export declare const ACCOUNT_STACK_NAME: string;
export type TargetReadinessReason = {
    kind: "missing-account-stack";
    stackName: string;
    region: string;
} | {
    kind: "missing-ipam-pool";
    accountId: string;
    region: string;
};
export type TargetReadinessVerdict = {
    ready: true;
} | {
    ready: false;
    reasons: TargetReadinessReason[];
    advisory: string;
};
/**
 * Both clients carry the target account's credentials, but their regions
 * differ: cloudFormation is scoped to the TARGET region (the Account stack
 * lives where the deploy lands); ec2 is scoped to the IPAM HOME region (the
 * platform stack's region) — RAM shares are created in the home region and
 * `DescribeIpamPools` returns nothing for shared pools anywhere else.
 */
export interface TargetReadinessClients {
    cloudFormation: CloudFormationClient;
    ec2: EC2Client;
}
export interface TargetReadinessAccount {
    id: string;
    /** Provider-account name when resolved from org config; omit otherwise. */
    name?: string;
}
export declare function describeTargetReadinessReason(reason: TargetReadinessReason): string;
/**
 * Shape-branched remediation for an unready deploy target (AC2b.1). Org
 * estates (a tier-organisation account in providerAccounts) remediate via the
 * cascade, which provisions every account and creates the IPAM pool; solo
 * accounts provision the target directly. The solo `target set` command embeds
 * the derived `{accountName}-{regionAbbrev}` target name — the only form
 * `target set` resolves — and degrades to `fjall target list` guidance when
 * the account name could not be resolved from org config.
 */
export declare function buildTargetUnreadyAdvisory(params: {
    accountId: string;
    accountName?: string;
    region: string;
    reasons: TargetReadinessReason[];
    providerAccounts?: OrgConfig["providerAccounts"];
}): string;
/**
 * Probe whether the governance CloudFormation stack (`Account` by default;
 * pass `stackName` for the platform-tier `Platform` shape) exists and is
 * provisioned in `region`. `success(true)` = a usable stack; `success(false)` = absent or
 * an unprovisioned shell (failed/rolled-back create, unexecuted change-set,
 * in-flight/failed delete); `failure` = the describe itself errored. Exported
 * so connect-time deploy-state probes reuse the same unprovisioned-status
 * interpretation as the deploy readiness path rather than re-deriving it.
 */
export declare function probeAccountStackExists(client: CloudFormationClient, region: string, abortSignal?: AbortSignal, stackName?: string): Promise<Result<boolean>>;
/**
 * Probe whether a deploy target is provisioned before any AWS mutation:
 * the governance stack must exist in the target region (`Account` for member
 * and solo accounts, `Platform` for a platform-tier target — its substrate
 * deploys under that name via `Platform extends Account`),
 * and for org estates (a tier-organisation account in providerAccounts) the
 * (account, region) IPAM pool must exist. Bootstrap is excluded — both deploy
 * paths self-heal it.
 *
 * Missing resources return an unready verdict carrying structured reasons and
 * the shape-branched advisory. Every probe error (AccessDenied, throttling,
 * network) propagates as failure — a mis-read "unready" refuses a legitimate
 * deploy, a mis-read "ready" lets a deploy fail mid-mutation; neither may be
 * guessed (mirrors describeAccountGlobalsExist).
 *
 * Failure messages stay raw — callers mask at their output boundary.
 */
export declare function checkTargetReadiness(clients: TargetReadinessClients, account: TargetReadinessAccount, region: string, orgConfig?: OrgConfig, abortSignal?: AbortSignal): Promise<Result<TargetReadinessVerdict>>;