/**
 * Domain helper: derive a content-addressed image tag from a buildx digest.
 *
 * Returns a tag of the shape `<serviceName>(-<target>)?-sha-<prefix>` where
 * `prefix` is the first 12 lowercase-hex characters of the digest's sha256
 * payload. The helper is the SOLE source of truth for content-hash tag
 * synthesis — every producer (`@fjall/cli` `EcrBuildOrchestrator`,
 * `@fjall/deploy-core` `dockerBuildHelper`) routes through it so a change
 * to the format propagates without per-call-site drift.
 *
 * Rejection cases:
 *   - digest not prefixed with `sha256:` (we never call other algorithms)
 *   - digest hex payload shorter than 12 chars
 *   - serviceName empty or whitespace-only
 *   - target supplied as whitespace-only (caller would typically omit it
 *     entirely; `""` is treated as "no target", surfaced via a failure so
 *     the caller cannot pass through an upstream-empty value silently)
 *
 * The Result type below is structurally identical to the canonical
 * `Result<T, E>` in `@fjall/generator/src/types/Result.ts`. `@fjall/util` is
 * the root of the workspace dep graph, so we cannot import the canonical
 * shape without creating a circular dependency. Consumers in
 * `@fjall/deploy-core` and `@fjall/cli` consume values produced here and
 * pass them through to canonical-`Result` consumers — structural identity
 * means TS catches drift if the canonical shape ever changes.
 */
export type Result<T, E = Error> = {
    success: true;
    data: T;
} | {
    success: false;
    error: E;
};
/**
 * Matches a tag synthesised by {@link deriveContentHashTag} — coupled to its
 * `${stem}-sha-${prefix}` output shape (code-quality.md § "Coupled values").
 * Consumers selecting a content-hash tag from a live tag list (e.g. the
 * restart orchestrator) MUST use this rather than re-encoding the shape.
 */
export declare const CONTENT_HASH_TAG_PATTERN: RegExp;
export declare function deriveContentHashTag(digest: string, serviceName: string, target?: string): Result<string, Error>;