/**
 * Landing-zone bootstrap composites — the Azure slice.
 *
 * Fixed-shape resources for greenfield creation of the recommended
 * governance foundation. The evaluability rules (EVL002/004) require
 * composites to declare a fixed set of resources, so these carry the
 * foundation only; arbitrary management-group/subscription trees are
 * authored as config with `landingZoneConfig()` (../governance.ts) and
 * reconciled by an external governance reconciler, and further groups/subscriptions
 * are declared as ordinary resources.
 *
 * A single ARM template cannot mix deployment scopes (AZR030, #1545), so
 * unlike the AWS/GCP slices the foundation splits per scope — each
 * composite emits at exactly one scope and belongs in its own project:
 *
 *   // tenant-scope project (management groups + subscription tenant policy)
 *   const lz = GovernanceFoundation({});
 *   // management-group-scope project, deployed to the tenant root group —
 *   // policy resources also deploy at subscription scope, so the project
 *   // pins the scope explicitly
 *   export const scope = deploymentScope("managementGroup");
 *   const gb = GovernanceBaseline({});
 *   const lr = LocationRestriction({ locations: ["westeurope"] });
 *   const al = ActivityLogSink({ workspaceId: "/subscriptions/.../workspaces/audit", location: "westeurope" });
 *
 * There is no OrganizationRoot analog — the tenant and its root management
 * group come from Entra ID, not the resource API, so greenfield and
 * brownfield both start from the existing tenant.
 */
import { ManagementGroup, PolicyAssignment, PolicyDefinition, policies as SubscriptionTenantPolicy } from "../generated/index.js";
export interface GovernanceFoundationProps {
    /** Management group the foundation hangs under. Default: the tenant root group. */
    parentId?: string;
    /** Block subscriptions from leaving the tenant (default true). */
    blockSubscriptionsLeavingTenant?: boolean;
}
export type GovernanceFoundationResult = {
    mgSecurity: InstanceType<typeof ManagementGroup>;
    mgInfrastructure: InstanceType<typeof ManagementGroup>;
    mgSandbox: InstanceType<typeof ManagementGroup>;
    mgWorkloads: InstanceType<typeof ManagementGroup>;
    subscriptionTenantPolicy: InstanceType<typeof SubscriptionTenantPolicy>;
};
/**
 * Security / Infrastructure / Sandbox / Workloads management groups with
 * subscriptions blocked from leaving the tenant — the same baseline
 * `landingZoneConfig()` declares. Deploys at tenant scope.
 */
export declare const GovernanceFoundation: import("@intentius/chant").CompositeDefinition<GovernanceFoundationProps, GovernanceFoundationResult>;
export type GovernanceBaselineProps = Record<string, never>;
export type GovernanceBaselineResult = {
    definitionDenyClassicResources: InstanceType<typeof PolicyDefinition>;
    definitionDenyUnmanagedDisks: InstanceType<typeof PolicyDefinition>;
    assignmentDenyClassicResources: InstanceType<typeof PolicyAssignment>;
    assignmentDenyUnmanagedDisks: InstanceType<typeof PolicyAssignment>;
};
/**
 * `deny-classic-resources` and `deny-unmanaged-disks` defined and assigned
 * at the management group the project deploys to (the tenant root group for
 * the `landingZoneConfig()` baseline). Custom policy definitions cannot
 * deploy at tenant scope, which is why this is not part of
 * GovernanceFoundation.
 */
export declare const GovernanceBaseline: import("@intentius/chant").CompositeDefinition<GovernanceBaselineProps, GovernanceBaselineResult>;
export interface LocationRestrictionProps {
    /** The only locations resources may be created in ("global" is always excepted). */
    locations: string[];
}
export type LocationRestrictionResult = {
    definitionLocationRestriction: InstanceType<typeof PolicyDefinition>;
    assignmentLocationRestriction: InstanceType<typeof PolicyAssignment>;
};
export declare const LocationRestriction: import("@intentius/chant").CompositeDefinition<LocationRestrictionProps, LocationRestrictionResult>;
export interface ActivityLogSinkProps {
    /** Resource id of the Log Analytics workspace activity logs flow into. */
    workspaceId: string;
    /** Region for the assignment's managed identity (DeployIfNotExists remediation). */
    location: string;
}
export type ActivityLogSinkResult = {
    assignmentActivityLogSink: InstanceType<typeof PolicyAssignment>;
};
/**
 * Assigns the built-in DeployIfNotExists policy that streams every
 * subscription's activity log into a Log Analytics workspace — current and
 * future subscriptions under the management group alike.
 */
export declare const ActivityLogSink: import("@intentius/chant").CompositeDefinition<ActivityLogSinkProps, ActivityLogSinkResult>;
//# sourceMappingURL=landing-zone.d.ts.map