/** AWS services provisioned inside a VPC that require customer-managed security groups. */
export declare const AWS_VPC_PROVISION_SERVICES: readonly ["rds", "neptune"];
export type AwsVpcProvisionService = (typeof AWS_VPC_PROVISION_SERVICES)[number];
export type AwsVpcEnvFields = {
    /**
     * Tags of security groups registered on the workspace cloud connection.
     * Ductape resolves these to AWS group ids at provision time.
     */
    securityGroups?: string[];
    /** @deprecated Use securityGroups tags registered on the cloud connection */
    vpcSecurityGroupIds?: string[];
};
export declare function parseSecurityGroupTags(raw: unknown): string[];
export declare function parseVpcSecurityGroupIds(raw: unknown): string[];
export declare function requireSecurityGroups(service: string, params: Record<string, unknown>): string[];
export declare function requireVpcSecurityGroupIds(service: string, params: Record<string, unknown>): string[];
export declare function requireAwsVpcEnvFields(provider: string, service: string, env: AwsVpcEnvFields): string[];
export declare function withAwsVpcProvisionFields<T extends Record<string, unknown>>(provider: string, service: string, env: AwsVpcEnvFields, fields: T): T & {
    securityGroups?: string[];
    publiclyAccessible?: boolean;
};
/** @deprecated Use withAwsVpcProvisionFields — provision fields belong on the input root */
export declare function withAwsVpcProvisionParams(provider: string, service: string, env: AwsVpcEnvFields, params: Record<string, unknown>): Record<string, unknown>;