/**
 * Cost-allocation tag keys, shared by producer and consumers:
 *
 * - Producer (`@fjall/components-infrastructure`): the fjall App applies
 *   these as global tags to every synthesised stack (`lib/app.ts`
 *   `applyTagsAspect()`), and `applyCostAllocationTags` stamps them on
 *   governance/domain scopes.
 * - Producer (`@fjall/deploy-core`): `cdk bootstrap` stamps the same keys
 *   onto the CDKToolkit stack via `--tags` (`orchestration/bootstrapTags.ts`),
 *   so the bootstrap roles/bucket/ECR repo stop surfacing as untagged,
 *   IaC-unmanaged assets in the posture scan.
 * - Consumer (webapp posture rules): `missing-required-tags` accepts the
 *   `fjall:costallocation:<required>` form (lowercased) for its
 *   owner/service/environment requirements, and any `fjall:`-prefixed key
 *   marks the asset Fjall-managed for `iac-unmanaged`.
 *
 * The literals are deployed infrastructure state — renaming a key orphans
 * every already-stamped resource (posture findings reopen fleet-wide) and
 * desynchronises the Organizations cost-allocation-tag activation, which
 * references the keys by name. The pin test in
 * `util/src/__tests__/costAllocationTags.test.ts` guards against casual
 * renames.
 */
export declare const COST_ALLOCATION_TAGS: {
    readonly ENVIRONMENT: "fjall:costAllocation:environment";
    readonly SERVICE: "fjall:costAllocation:service";
    readonly DOMAIN: "fjall:costAllocation:domain";
    readonly OWNER: "fjall:costAllocation:owner";
};
/**
 * Environment tag value for scopes with no workload stage — the organisation
 * management (root) account and stage-less governance resources.
 */
export declare const DEFAULT_COST_ALLOCATION_ENVIRONMENT: "management";
/**
 * Owner tag value when nothing more specific is known. Two producers share
 * it: the fjall App stamps it tree-wide when neither an explicit
 * `addTags` owner nor an orgId context resolves (`lib/app.ts`
 * `applyTagsAspect()`), and the generator's `generateTags` emits it into
 * scaffolded `addTags` blocks when the plan carries no owner — so every
 * estate satisfies the posture `missing-required-tags` owner requirement
 * without manual tagging.
 */
export declare const DEFAULT_COST_ALLOCATION_OWNER: "engineering";
/** SDK tag shape (`{ Key, Value }`) shared by the RDS and ECR create/tag commands. */
export interface AwsSdkTag {
    readonly Key: string;
    readonly Value: string;
}
/** SDK tag shape accepted by `CreateRepositoryCommand`. */
export type EcrCreateTag = AwsSdkTag;
/**
 * Tag set for the runner-taken pre-migration RDS snapshot: the source
 * database's cost-allocation tags (`fjall:costAllocation:*`, mirrored
 * verbatim — never any other key, so `aws:`-reserved and user tags stay
 * behind) plus the `fjall:snapshotKind=premigrate` marker. Passing `Tags` on
 * `CreateDBSnapshot` suppresses RDS's `CopyTagsToSnapshot` copy, so the
 * mirror is what keeps snapshot storage attributable to the owning
 * service/environment. `sourceTags` is the instance's `ListTagsForResource`
 * `TagList`; entries missing a key or value are skipped.
 */
export declare function rdsPreMigrationSnapshotTags(sourceTags: ReadonlyArray<{
    Key?: string;
    Value?: string;
}>): AwsSdkTag[];
/**
 * Cost-allocation tag set for SDK-created ECR repositories (the buildx
 * registry-cache repos and the schema-gate mirror repo — everything ECR the
 * CDK constructs do NOT synthesise). The service value is the repository name:
 * it is the one identity every creation path shares byte-identically, which
 * matters for the cache repos — the `fjall build` provisioner
 * (`@fjall/cli` EcrRepositoryService) and the deploy-path provisioner
 * (`@fjall/deploy-core` ensureBuildCacheRepository) both create the SAME
 * physical repo, so their tag sets must not drift. No environment tag: these
 * repos are account-scoped and shared across every stage in the account.
 * Tags apply on create only — already-existing repos are never retro-tagged.
 */
export declare function ecrCreateRepositoryTags(repositoryName: string): EcrCreateTag[];