import type { ProviderAccount } from "@fjall/util/config";
import type { DeployParams } from "../../types/params.js";
import type { OrgConfig } from "../../types/config/orgConfig.js";
import type { OrganisationOperation } from "../../types/operations.js";
import type { DomainsTakeoverWithheld } from "../domain/domainTakeoverGate.js";
import type { DeployServices } from "../serviceFactory.js";
/**
 * Execute the cascade phases: platform deploy, IPAM pool read, domains, and
 * the member-account fan-out, finishing with the ledger callbacks.
 *
 * Pushes per-target failures onto `cascadeErrors` and captured stack outputs
 * onto `allCascadeOutputs` (both caller-owned). Returns whether any cascade
 * target actually deployed (vs every target skipping as unchanged).
 */
export declare function executeCascade(params: DeployParams, services: DeployServices, operation: OrganisationOperation, args: {
    providerAccounts: ProviderAccount[];
    effectiveOrgConfig: OrgConfig | undefined;
    totalSteps: number;
    cascadeErrors: Array<{
        accountId: string;
        error: string;
    }>;
    allCascadeOutputs: Array<{
        accountId: string;
        outputs: Record<string, string>;
    }>;
    /** AWS Organizations org id — the owner cost-allocation tag each cascade
     * bootstrap stamps on its account's CDKToolkit stack. */
    orgId?: string;
}): Promise<{
    anyCascadeDeployHappened: boolean;
    /** Zones the domains phase actually deployed (P6 per-zone retirement). */
    deployedDomainZones: readonly string[];
    /**
     * Present when the domains-phase takeover gate withheld consent: the
     * member fan-out was SKIPPED (members depend on domain DNS — certificate
     * validation records above all) and the caller must surface the ticket as
     * a destruction-pending result.
     */
    domainsTakeover?: DomainsTakeoverWithheld;
}>;