/**
 * Azure governance authoring: the desired-state config
 * shape an external governance reconciler reconciles, and `landingZoneConfig()` — the
 * typed authoring layer that emits it.
 *
 * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
 * #916/#952) require composites to declare a fixed set of resources, so a
 * data-driven management-group tree walker cannot be one. The split mirrors
 * the AWS/GCP slices (lexicons/{aws,gcp}/src/governance.ts): authoring emits
 * config (this module, arbitrary cardinality); resources for greenfield
 * bootstrap are the fixed-shape composites in `composites/landing-zone.ts`;
 * the reconciler consumes only the config.
 *
 * Azure has no OrganizationRoot analog — the tenant and its root management
 * group come from Entra ID, never from the resource API. Subscriptions the
 * tree declares reconcile through Microsoft.Subscription/aliases (existing
 * ids are placed, missing ones created from `billingScope`); aliases deploy
 * at tenant scope only (#1545).
 */
/** A custom policy definition, keyed by name in `AzureGovernanceConfig.policies`. */
export interface PolicyConfig {
    description?: string;
    displayName?: string;
    /** The policy definition mode ("All", "Indexed", …). Defaults to "All". */
    mode?: string;
    /** Parameter definitions for parameters used in the policy rule. */
    parameters?: Record<string, unknown>;
    /** The policy rule (if/then). */
    policyRule: Record<string, unknown>;
}
/** A subscription declared inside a management group. */
export interface SubscriptionConfig {
    name: string;
    /** An existing subscription to place. Omitted: the reconciler creates one via a tenant-scope alias. */
    subscriptionId?: string;
    /** Billing scope for subscriptions the reconciler creates. */
    billingScope?: string;
    workload?: "Production" | "DevTest";
}
/** One management group: its guardrails, subscriptions, and children, keyed by group id. */
export interface ManagementGroupConfig {
    /** Defaults to the group id (the tree key). */
    displayName?: string;
    /** Names of policies (from `policies`) assigned to this management group. */
    policies?: string[];
    subscriptions?: SubscriptionConfig[];
    children?: Record<string, ManagementGroupConfig>;
}
/**
 * The desired-state governance tree for one Azure tenant. This is the shape
 * an external governance reconciler loads as config — the Azure counterpart of
 * `AwsGovernanceConfig`/`GcpGovernanceConfig`. Cycles map onto the
 * governance verbs: the management-group/subscription tree is
 * `org-unit`, policy assignments are `policy-guardrail`, the activity-log
 * sink is `audit-sink`.
 */
export interface AzureGovernanceConfig {
    tenant: {
        /** Policy names assigned at the tenant root management group. */
        policies?: string[];
        /** Block subscriptions from leaving the tenant (Microsoft.Subscription/policies). */
        blockSubscriptionsLeavingTenant?: boolean;
    };
    /** Top-level management groups under the tenant root, keyed by group id. */
    managementGroups: Record<string, ManagementGroupConfig>;
    /** Custom policy definitions, keyed by the names the tree assigns. */
    policies: Record<string, PolicyConfig>;
    /** Where audit evidence flows. */
    auditSinks?: {
        activityLog?: {
            workspaceId: string;
        };
    };
}
export declare const DENY_CLASSIC_RESOURCES: PolicyConfig;
export declare const DENY_UNMANAGED_DISKS: PolicyConfig;
/** Allow resource creation only in `locations` ("global" is always excepted). */
export declare function locationRestriction(locations: readonly string[]): PolicyConfig;
/**
 * The built-in DeployIfNotExists policy "Configure Azure Activity logs to
 * stream to specified Log Analytics workspace" — the activity-log audit
 * sink is wired by assigning it, not by declaring diagnostic settings in
 * every subscription (Microsoft.Insights/diagnosticSettings is not in the
 * generated surface, and the assignment covers future subscriptions too).
 */
export declare const ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID = "/providers/Microsoft.Authorization/policyDefinitions/2465583e-4e78-4c15-b6be-a36cbc7c8b0f";
/**
 * The recommended foundation management-group structure. Exported so
 * callers can extend it rather than restate it.
 */
export declare const FOUNDATION_MANAGEMENT_GROUPS: Record<string, ManagementGroupConfig>;
export interface LandingZoneConfigProps {
    /**
     * Start from the recommended foundation: Security / Infrastructure /
     * Sandbox / Workloads management groups, `deny-classic-resources` and
     * `deny-unmanaged-disks` assigned at the tenant root, and subscriptions
     * blocked from leaving the tenant. Default true; your
     * `managementGroups`/`policies` merge over it (same-name keys win).
     */
    foundation?: boolean;
    /** Adds a root allowed-locations policy allowing only these locations. */
    allowedLocations?: string[];
    /** Management-group tree, merged over the foundation's. Greenfield (full tree) and brownfield (partial subtree) are both just this map. */
    managementGroups?: Record<string, ManagementGroupConfig>;
    /** Policy definitions, merged over the foundation's. */
    policies?: Record<string, PolicyConfig>;
    /** Extra policy names to assign at the tenant root management group. */
    rootPolicies?: string[];
    /** Declare the activity-log audit sink flowing into this Log Analytics workspace (resource id). */
    activityLogWorkspaceId?: string;
}
/**
 * Author the desired-state tree an external governance reconciler reconciles. Pure.
 * Throws when the tree assigns a policy name with no definition; only
 * policies the tree actually assigns are included in the output.
 */
export declare function landingZoneConfig(props?: LandingZoneConfigProps): AzureGovernanceConfig;
//# sourceMappingURL=governance.d.ts.map