import type { ChildEnvPolicy } from "@fjall/util";
import { CloudFormationClient } from "@aws-sdk/client-cloudformation";
import { type Result } from "@fjall/generator";
import type { AwsCredentials } from "../../types/credentials.js";
import type { DomainHome, DomainProviderFactory, DomainDeployProvider } from "../domainInterface.js";
import { WorkerDomainDeployProvider } from "./WorkerDomainDeployProvider.js";
/**
 * Per-home credential strategy for `createCascadeDomainProviderFactory`. The
 * returned credentials MUST be bound to the home they were minted for
 * (`accountId`/`region` echo the home) — the factory refuses a mismatch
 * fail-closed rather than deploy one home under another home's identity.
 *
 * CLI: assumes the home's CascadeDeploymentRole from the ambient management
 * identity (`assumeCascadeRole`). Worker: mints a per-home OIDC session.
 */
export type HomeCredentialsMinter = (home: DomainHome) => Promise<Result<AwsCredentials>>;
export interface CascadeDomainProviderFactoryParams {
    /**
     * How the CDK children of every home's domain deploy inherit the caller's
     * environment. REQUIRED — see `DeployParams.childEnvPolicy`; threaded
     * unchanged into each `WorkerDomainDeployProvider`.
     */
    childEnvPolicy: ChildEnvPolicy;
    /** Injected credential strategy — the only surface-specific ingredient. */
    mintHomeCredentials: HomeCredentialsMinter;
    /** Absolute path of the checkout the cascade deploys domain components from. */
    workingDirectory: string;
    /** Repo-relative boundary directory (e.g. `fjall`) holding fjall-config.json. */
    boundaryDir: string;
    /** Serialised org config threaded into each provider's CDK context. */
    orgConfigSerialised?: string;
    /**
     * The EXECUTING identity's CloudFormation reader, seeded into the
     * foreign-parent registry. The executing home never passes through the
     * factory, yet it is the most common PARENT home of all: a routed child
     * whose apex lives with the management account resolves the delegation-role
     * export through this seed.
     */
    executingParentReader?: {
        accountId: string;
        cfn: Pick<CloudFormationClient, "send">;
    };
    /**
     * Surface-specific wrap of each minted provider — e.g. the CLI's
     * deploy-state + P6 reporting decorator. The concrete worker type is
     * deliberate: decorators may rely on every provider seam being present.
     */
    decorateProvider?: (provider: WorkerDomainDeployProvider, home: DomainHome) => DomainDeployProvider;
    abortSignal?: AbortSignal;
}
/**
 * T2 account routing, shared assembly: build a `DomainProviderFactory` whose
 * groups deploy through `WorkerDomainDeployProvider` under per-home
 * credentials. The credential strategy is injected; everything
 * strategy-independent lives here once — provider construction, the group's
 * AwsProvider, and the shared foreign-parent reader registry.
 *
 * The registry is the subtle part: a routed child whose PARENT zone lives in
 * another home needs a CloudFormation reader for the parent's account to read
 * the delegation-role export there (`resolveForeignParentCfn` rung). Every
 * minted home registers its client; resolution happens at DEPLOY time, after
 * the engine's pass-1 minting loop has registered every home, so a group
 * minted early still sees clients registered later. First-mint-wins keeps the
 * registry deterministic (homes mint in config first-appearance order) and
 * keeps the executing seed authoritative when a foreign home shares the
 * executing ACCOUNT under another region.
 */
export declare function createCascadeDomainProviderFactory(params: CascadeDomainProviderFactoryParams): DomainProviderFactory;