/**
 * The SDK pre-empty marker tag, shared by producer and consumer:
 *
 * - Producer (`@fjall/components-infrastructure`): the `S3Bucket` wrapper
 *   (`storage/s3.ts`) tags every DESTROY-policy bucket so destroy paths
 *   know it is safe to SDK-empty before CloudFormation delete (Phase 3
 *   autoDeleteObjects retirement).
 * - Consumer (`@fjall/deploy-core`): `stackCleanup/bucketOps.ts` includes
 *   the key in `PRE_EMPTY_TAG_KEYS` — presence with value "true" opts a
 *   stack bucket into the pre-empty pass; a bucket carrying no pre-empty
 *   tag (Retain) is never touched.
 *
 * The literal is deployed infrastructure state — already-tagged buckets
 * would silently lose pre-empty coverage (and so re-expose the quarantine
 * window) on any rename. The pin test in `__tests__/infraTags.test.ts`
 * guards against casual renames.
 */
export declare const SDK_PRE_EMPTY_TAG_KEY = "fjall:sdk-pre-empty";
/**
 * The KMS retention marker tag, shared by producer and consumer:
 *
 * - Producer (`@fjall/components-infrastructure`): `CustomerManagedKey`
 *   (`secrets/kms.ts`) tags every key whose resolved removal policy is
 *   RETAIN, valued with the `protects` scope that justified the retention.
 * - Consumer (webapp posture): the `KMS_KEY_ORPHAN` tier-policy row reads it
 *   to tell a key retained on purpose from one that was forgotten (tier-aware
 *   alert policy design 2026-09-01 §8 K4). The row waits until deployed keys
 *   carry the tag.
 *
 * The literal is deployed infrastructure state: a rename would strip every
 * retained key of its marker until the next deploy. The pin test in
 * `__tests__/infraTags.test.ts` guards against casual renames.
 */
export declare const KMS_RETENTION_TAG_KEY = "fjall:kms:retention";
/**
 * The KMS alias marker tag, stamped beside [[KMS_RETENTION_TAG_KEY]] on every
 * retained key and valued with the key's alias name as `kms list-aliases`
 * reports it (`alias/cmk/<stack>/FjallStackEncryptionKey`).
 *
 * A retained key outlives its stack; its `AWS::KMS::Alias` does not — the
 * alias is an ordinary stack resource and goes with the stack delete — and
 * CloudFormation stamps none of its `aws:cloudformation:*` tags on KMS keys.
 * So once the stack is gone nothing but this tag says which key a stack's
 * `FjallStackEncryptionKey` was. The deploy-test harness reads it back
 * (`deploy-tests/lib/releaseStackKeys.mts`) to find the stack keys a
 * torn-down suite retained, and a posture scan can name a stray key's
 * origin by it.
 *
 * Deployed infrastructure state, pinned like its sibling: a rename would
 * strip every retained key of its origin until the next deploy.
 */
export declare const KMS_ALIAS_TAG_KEY = "fjall:kms:alias";
/**
 * The Fjall resource-type marker tag key, shared by producers and consumers:
 *
 * - Producer (`@fjall/components-infrastructure`): `applyResourceTypeTag` /
 *   `markDeployTimeWriter` (`lib/utils/resourceTypeTags.ts`) stamp it on the
 *   VPC peering constructs and on every custom-resource writer subtree.
 * - Producer (the Quick-Create connector template,
 *   `public-assets/fjall/public-assets/assets/oidc-connector.yaml`): the three
 *   writer role/function pairs carry the same key and value as the CDK twin.
 * - Consumer (webapp posture): `isDeployTimeOnlyRole`
 *   (`app/.server/services/compliance-rules/complianceUtils.ts`) matches the
 *   marker before any role-name pattern, so a CloudFormation-named role is
 *   excluded from `IAM_ROLE_UNUSED` by what it IS, not what it is called.
 *
 * The literal is deployed infrastructure state: renaming the key strips every
 * already-tagged resource of its marker until the next deploy, and the posture
 * exclusion then reports every role whose only exemption was the marker. The
 * pin test in `__tests__/infraTags.test.ts` guards against casual renames.
 */
export declare const FJALL_RESOURCE_TYPE_TAG_KEY = "fjall:resource:type";
/**
 * The closed vocabulary of `fjall:resource:type` values. One value per class
 * of resource whose identity cannot be read off its physical name — never a
 * second tag key, and never a per-construct value: `deployTimeWriter` is the
 * single class for every role that CloudFormation assumes only while driving a
 * custom resource (connector writers, IPAM, RDS, TLS, return-routes, identity
 * store, aws-cdk-lib's own hoisted providers), the class the unused-role
 * exclusion carves out.
 *
 * What stays on that exclusion's NAME patterns is enumerated, not inferred by
 * subtraction, and it is three sets: roles AWS or the CDK bootstrap stack
 * create, which Fjall can never tag (`OrganizationAccountAccessRole`, the five
 * bootstrap roles); roles Fjall emits with deterministic names that are NOT
 * deploy-time writers (the connector deploy role, the DNS delegation roles,
 * the dev-tier trio); and the connector writer roles
 * (`Fjall{OIDCProvider,DeployBoundary,Callback}Lambda<orgId>`), which ARE
 * marked — by the Quick-Create template named above — and keep a name clause
 * only to cover connector stacks deployed before the marker release. That
 * third set is the only LEGACY one, and the only clause that retires.
 * aws-cdk-lib's hoisted singleton is in none of the three — it is marked, so
 * it is exempt by marker alone, and a singleton in a stack Fjall did not
 * synthesise carries no marker and IS reported.
 *
 * CDK resolves tag conflicts deeper-scope-wins, so a writer nested inside a
 * `vpcPeering` subtree resolves to `deployTimeWriter` — the more specific
 * truth about that role.
 */
export declare const FJALL_RESOURCE_TYPES: {
    readonly vpcPeering: "vpc-peering";
    readonly vpcPeeringAccepter: "vpc-peering-accepter";
    readonly deployTimeWriter: "deploy-time-writer";
};
export type FjallResourceType = (typeof FJALL_RESOURCE_TYPES)[keyof typeof FJALL_RESOURCE_TYPES];
/**
 * The S3 versioning-exemption marker tag, shared by producer and consumer:
 *
 * - Producer (`@fjall/components-infrastructure`): the `S3Bucket` wrapper
 *   (`storage/s3.ts`) stamps a bucket whose author passed
 *   `versioningExemption`, and only when the bucket's resolved `versioned`
 *   is false — a bucket that versions after all has nothing to exempt. The
 *   value names why versioning is off by design: `build-output` (Payload
 *   assets, pruned on every deploy), `isr-cache` (Payload ISR cache,
 *   regenerated at runtime), `cold-tier` (ClickHouse cold-tier storage, the
 *   table's own tiered parts), `access-logs` (the stack's access-log
 *   delivery bucket, lifecycle-expired; versioning would only multiply the
 *   expired objects).
 * - Consumer (webapp posture): the `S3_VERSIONING_DISABLED` tier-policy rows
 *   read key and value to land the finding `mitigated` on every bucket the
 *   design exempts (tier-aware alert policy design 2026-09-01 §8 K4), one
 *   signal for every construct site instead of a logical id per site.
 *
 * Key and values are deployed infrastructure state, read back by the same
 * literals: a rename would return every exempt bucket to `open` until the
 * next deploy. The pin test in `__tests__/infraTags.test.ts` guards against
 * casual renames.
 */
export declare const S3_VERSIONING_EXEMPT_TAG_KEY = "fjall:s3:versioning-exempt";
/** The exemptions the tag may carry — each names a bucket whose contents are rebuilt, not kept. */
export declare const S3_VERSIONING_EXEMPTIONS: readonly ["build-output", "isr-cache", "cold-tier", "access-logs"];
export type S3VersioningExemption = (typeof S3_VERSIONING_EXEMPTIONS)[number];
/**
 * The S3 backup-exemption marker tag — the versioning exemption's sibling, for
 * the buckets the versioning one structurally cannot cover.
 *
 * `S3_VERSIONING_EXEMPT_TAG_KEY` is stamped only when the resolved `versioned`
 * is false. These buckets are versioned and stay versioned; what they are not
 * is a *backup source*. AWS Backup selects by tag with no resource-type
 * filter, so a versioned bucket carrying `fjall:disasterRecovery:tier` is a
 * bucket AWS Backup will copy — and for a bucket an AWS service delivers to
 * continuously, that is a copy of a log stream that already has its own
 * retention, not a recovery point anybody would restore.
 *
 * - Producer (`@fjall/components-infrastructure`): the `S3Bucket` wrapper
 *   (`storage/s3.ts`) stamps a bucket whose author passed `backupExemption`,
 *   and only when the bucket is versioned — an unversioned bucket is already
 *   outside every plan, so it has nothing to exempt. The value names why the
 *   bucket is not a source: `log-delivery` (an AWS service writes to it
 *   continuously under its own lifecycle — VPC flow logs, CloudTrail, Config
 *   delivery).
 * - Consumer (webapp posture): the `MISSING_DR_TIER_TAG` rule reads key and
 *   value to tell a versioned bucket that is deliberately not enrolled from
 *   one that lost its tier by omission. Without it the rule raises a
 *   permanent finding whose own auto-remediation cannot clear it, because no
 *   construct will ever stamp that bucket.
 *
 * Key and values are deployed infrastructure state, read back by the same
 * literals: a rename would return every exempt bucket to `open` until the next
 * deploy. The pin test guards against casual renames.
 */
export declare const S3_BACKUP_EXEMPT_TAG_KEY = "fjall:s3:backup-exempt";
/** The exemptions the tag may carry — each names a bucket that receives a service's log stream rather than holding recoverable state. */
export declare const S3_BACKUP_EXEMPTIONS: readonly ["log-delivery"];
export type S3BackupExemption = (typeof S3_BACKUP_EXEMPTIONS)[number];