export declare const DNS_APEX: "@";
/**
 * CloudFormation stack name for a domain component (D2 wiring contract).
 *
 * Mirrors the domain generator's app naming (`cli/generators/domain/
 * generator.ts`: `toPascalCase(domainName.split(".").join(""))` + `Domain`,
 * the name passed to both `App.getApp(...)` and `app.getStack(...)` in the
 * emitted `infrastructure.ts` — the stack key IS the deployed stack name),
 * e.g. `example.com` → `ExamplecomDomain`. Both the deploy-state record
 * (`domainDeployOperation`) and the binding resolution
 * (`DomainService.resolveDomainForApp` → DescribeStacks) MUST derive the name
 * through this helper so the stack the deploy recorded is the stack the
 * resolution describes.
 */
export declare function getDomainStackName(domainName: string): string;
/**
 * Name of a domain stack's paired us-east-1 certificate stack (D3 contract).
 *
 * When a domain declares a `cloudFront: true` certificate and the domain
 * stack itself does NOT deploy to us-east-1, the Domain construct mints the
 * certificate (and the `<zone>-us-east-1-certificate-arn` export) in this
 * paired stack instead, us-east-1 being the only region CloudFront accepts
 * viewer certificates from. Both the construct side
 * (`composeDomainCertificates`) and the read side
 * (`DomainService.resolveDomainForApp`, which describes the paired stack
 * with a us-east-1 CloudFormation client) MUST derive the name here so the
 * stack the synth mints is the stack the resolution reads.
 */
export declare function getDomainUsEast1CertificatesStackName(domainStackName: string): string;
/**
 * Two-step deploy phase for constructs whose certificates must not be issued
 * before their zone's NS delegation has propagated (design R2 cert-hang
 * guard). `"zone"` synthesises the hosted zone (+ delegation record) only;
 * `"full"` additionally issues certificates. Shared by the delegated `Domain`
 * topology, `DevSubstrate`, and the deploy-core two-phase orchestration —
 * homed here (the lowest layer) so the construct and deploy sides read one
 * contract.
 */
export type DomainDeployPhase = "zone" | "full";
/**
 * Default deploy phase when `phase` is omitted — the complete build. The
 * two-step guard (R2) sets `"zone"` explicitly for step 1, so the safe
 * default for a single-shot deploy is everything.
 */
export declare const DOMAIN_DEPLOY_DEFAULT_PHASE: DomainDeployPhase;
/**
 * Compute predictable CloudFormation export names for domain stack outputs.
 * Used by both infrastructure constructs (to set export names) and CLI services
 * (to import zone ID, certificate ARN, and delegation role ARN via Fn.importValue).
 */
export declare function getDomainExportNames(domainName: string): {
    hostedZoneId: string;
    certificateArn: string;
    certificateHosts: string;
    usEast1CertificateArn: string;
    usEast1CertificateHosts: string;
    delegationRoleArn: string;
    nameservers: string;
};
/**
 * CloudFormation caps output values at 1024 bytes; hosts lists serialise
 * against a 1000-byte threshold for headroom under the hard cap. Shared by
 * every hosts-output emitter ({@link serialiseHostsChunks}).
 */
export declare const HOSTS_OUTPUT_MAX_BYTES = 1000;
/**
 * Serialise a certificate's hosts list into one-or-more JSON-array strings,
 * each under {@link HOSTS_OUTPUT_MAX_BYTES}. One chunk → the emitter keeps
 * the base export name (byte-identical to the single-output era); more →
 * the {@link hostsExportPartName} family replaces the base name. The SSOT
 * for the chunking algorithm: the Domain construct's certificate composer
 * and the CLI's eject templates must split identically, or an ejected
 * stack would rename the deployed hosts outputs.
 */
export declare function serialiseHostsChunks(hosts: string[]): string[];
/**
 * Export name of chunk `part` (1-based) of a certificate-hosts list too
 * large for one CloudFormation output value. The part family REPLACES the
 * base export name entirely when chunking engages — the base name is
 * OMITTED, never emitted with a partial list, so a consumer that only knows
 * the base name reads absence (coverage-unknown, the honest degraded
 * answer) rather than a partial list it would misread as complete and turn
 * into a false not-covered verdict. Consumers that know the family read
 * `-1`, `-2`, … until the first absent part and concatenate.
 */
export declare function hostsExportPartName(baseExportName: string, part: number): string;
/**
 * Props for importing zone and certificate from a managed domain stack.
 * When set, app constructs use Fn.importValue() instead of creating inline.
 * Export-name (bare-CDK) fallback: Fn.importValue resolves same-account,
 * same-region only. CLI-driven deploys prefer {@link ManagedDomainBinding}.
 */
export interface ManagedDomainExports {
    hostedZoneIdExport: string;
    certificateArnExport: string;
    zoneName: string;
}
/**
 * Literal-value counterpart to {@link ManagedDomainExports} (D2, domain
 * gold-plating). At deploy time the CLI resolves the domain stack's outputs
 * via DescribeStacks in that stack's own region and injects concrete values
 * into synth. Literal values carry no Fn.importValue constraint (they cross
 * accounts and regions) and keep CDK's CloudFront certificate-region synth
 * guard effective, because the ARNs stay inspectable rather than tokens.
 */
export interface ManagedDomainBinding {
    zoneName: string;
    /** Literal hosted-zone ID — the discriminant against `hostedZoneIdExport`. */
    hostedZoneId: string;
    /** Regional certificate ARN (ALB/ECS consumers). */
    certificateArn?: string;
    /** us-east-1 certificate ARN for CloudFront consumers (D3). */
    usEast1CertificateArn?: string;
    /** Parent DelegationRole ARN for child-writes NS delegation (D8), always literal. */
    delegationRoleArn?: string;
}
/**
 * Certificate-coverage companion to {@link ManagedDomainBinding} (design
 * 2026-08-18 cdn-app-origin, D5). Carries the hostnames covered by exactly
 * the two certificates the binding names — `certificateHosts` for
 * `certificateArn`, `usEast1CertificateHosts` for `usEast1CertificateArn` —
 * read from the domain stack's per-certificate hosts outputs. Injected as a
 * SEPARATE context key (`fjall:managedDomainCoverage:<zone>`), never folded
 * into the binding JSON: the binding parser fails closed on unknown fields,
 * so extending the binding would break older-engine synths fed by a newer
 * CLI, while a separate key is invisible to them by construction. A field is
 * absent when the domain stack predates the hosts outputs — consumers must
 * treat absence as coverage-unknown (warn), never as not-covered.
 */
export interface ManagedDomainCoverage {
    /** Hostnames covered by the binding's regional `certificateArn`. */
    certificateHosts?: string[];
    /** Hostnames covered by the binding's `usEast1CertificateArn` (D3). */
    usEast1CertificateHosts?: string[];
}
/**
 * Discriminate a `ManagedDomainExports | ManagedDomainBinding` union so
 * constructs accepting `managedDomain` can branch: a binding carries the
 * literal `hostedZoneId`; the export-name form carries `hostedZoneIdExport`.
 */
export declare function isManagedDomainBinding(value: ManagedDomainExports | ManagedDomainBinding): value is ManagedDomainBinding;