import { type Result } from "@fjall/generator";
import type { DeployIdentity } from "../types/credentials.js";
/**
 * The runtime half of typescript-standards § "A field that gates a security
 * behaviour is REQUIRED at the seam". `identity` is required, so an OMITTED
 * organisation id fails typecheck — but `""` is a string, and downstream an
 * empty `fjallOrgId` reads as absent (the CDK argument builder drops the
 * `-c fjallOrgId` context for `""`, the OIDC/deploy-role globals are then
 * never configured, and the bootstrap cap is named after nothing). Every
 * producer already refuses it (the CLI's `OrgConfigClient` guards the empty
 * id; the worker's job schema is `.min(1)`), so this is the engine refusing
 * to be the one seam that would let it through. The message is identifier
 * -only: nothing here can carry a credential.
 */
export declare function validateDeployIdentity(identity: DeployIdentity): Result<DeployIdentity>;