import { type Result } from "@fjall/generator";
import type { AwsProvider } from "../../aws/AwsProvider.js";
import type { OUTree, AccountInfo } from "../../aws/organisations/types.js";
/**
 * Execution-order tuple of org-setup phases — single source of truth for the
 * OrgSetupPhase union. The engine's hand-written phase blocks are tethered to
 * this tuple by the "starts every declared phase" test in
 * organisationSetup.test.ts: a variant added here without an engine block
 * fails that test; an engine literal not listed here fails typecheck
 * (executePhase/skipPhase take OrgSetupPhase).
 */
export declare const ORG_SETUP_PHASES: readonly ["create-organisation", "enable-policies", "enable-service-access", "enable-root-access", "enable-ram-sharing", "activate-trusted-access", "enable-ipam", "configure-backup", "create-accounts", "create-organisational-units", "place-accounts", "activate-cost-tags", "check-identity-centre", "register-security-delegates"];
export type OrgSetupPhase = (typeof ORG_SETUP_PHASES)[number];
export interface OrgSetupCallbacks {
    onPhaseStart?(phase: OrgSetupPhase): void;
    onPhaseComplete?(phase: OrgSetupPhase, result: "completed" | "skipped" | "error"): void;
    onProgress?(message: string): void;
    /**
     * Posture-change warnings that must be visible but never block the phase
     * (e.g. the AC2.8 imported-account warning). Adapters that do not handle
     * this receive the same message through onProgress instead.
     */
    onWarning?(phase: OrgSetupPhase, message: string): void;
    onError?(phase: OrgSetupPhase, error: Error): void;
}
export interface OrgSetupConfig {
    accounts: Array<{
        name: string;
        email: string;
    }>;
    platformAccountId?: string;
    organisationalUnits: string[] | OUTree;
    accountPlacements?: AccountInfo[];
    costAllocationTags?: string[];
    skipIdentityCentre?: boolean;
    skipRootAccessManagement?: boolean;
    securityDelegateAccountId?: string;
}
export interface OrgSetupResult {
    organisationId: string;
    createdAccounts: Array<{
        name: string;
        accountId: string;
    }>;
    identityCentreStatus?: string;
    phasesCompleted: OrgSetupPhase[];
    phasesSkipped: OrgSetupPhase[];
    errors: Array<{
        phase: OrgSetupPhase;
        error: string;
    }>;
}
/**
 * Orchestrate the full AWS Organisation setup sequence.
 *
 * Runs up to 14 phases sequentially. Non-fatal phase failures are recorded
 * and execution continues. The only fatal failure is phase 1
 * (create-organisation) since all subsequent phases depend on the org ID.
 *
 * @param abortSignal Optional shutdown signal — short-circuits the long
 *   account-creation and policy-enable polls so a SIGTERM-driven worker
 *   shutdown is not stalled by in-flight sleeps
 */
export declare function runOrganisationSetup(awsProvider: AwsProvider, config: OrgSetupConfig, callbacks?: OrgSetupCallbacks, abortSignal?: AbortSignal): Promise<Result<OrgSetupResult>>;