import { type Result } from "@fjall/generator";
import { ConfigError } from "../../types/errors/ServiceError.js";
import type { OUTree } from "../../aws/organisations/types.js";
export type AccountsConfig = {
    readonly [key: string]: string | readonly string[] | AccountsConfig;
};
/**
 * Scaffold buckets that are OU structure ONLY — accounts placed here get an
 * organisational unit but no workload stage (ADR
 * 2026-04-07-nested-ou-accounts-structure: environments resolve solely from
 * the five stage leaf keys). Producers mapping leaf keys to wire
 * `environment` values must decode these buckets to a null stage rather than
 * forwarding the key verbatim — the org-config ingress enum rejects them.
 */
export declare const OU_ONLY_ACCOUNT_BUCKETS: readonly ["security", "suspended"];
/** Type guard: checks whether an ACCOUNTS leaf key is an OU-only bucket. */
export declare function isOuOnlyAccountBucket(key: string): boolean;
export declare function isStringArray(value: unknown): value is string[];
export declare function isAccountsConfig(value: unknown): value is AccountsConfig;
/**
 * Recursively extract account→environment pairs using leaf keys.
 * Parent keys (e.g. "workloads") are skipped — only leaf keys become environments.
 */
export declare function flattenAccountsToEnvironments(config: AccountsConfig): Array<{
    accountName: string;
    environment: string;
}>;
/**
 * Extract all account names from any depth of nesting.
 */
export declare function extractAllAccountNames(config: AccountsConfig): string[];
/**
 * Convert AccountsConfig to deploy-core's OUTree format for nested OU creation.
 */
export declare function accountsConfigToOUTree(config: AccountsConfig): OUTree;
/**
 * Parse the ACCOUNTS configuration from `<baseDir>/fjall/organisation/infrastructure.ts`.
 * Returns null (not an error) if the file does not exist. The import is
 * bounded by `options.timeoutMs` (default PARSE_ACCOUNTS_TIMEOUT_MS); expiry
 * surfaces as a ConfigError failure like any other import error.
 *
 * `baseDir` is the repository root — `process.cwd()` for the CLI (run from the
 * user's repo) and the prepared-clone `workingDirectory` for the worker. There
 * is intentionally no `process.cwd()` default: in the worker `process.cwd()` is
 * the worker dir, not the clone, so callers must pass the resolved base.
 */
export declare function parseAccountsConfiguration(baseDir: string, options?: {
    timeoutMs?: number;
}): Promise<Result<AccountsConfig | null, ConfigError>>;