/**
 * Cross-package contract constants for the migration runner. Imported by both
 * `@fjall/components-infrastructure` (CDK synth, IAM globs, env-var injection)
 * and `webapp/scripts/migration-runner.mjs` (runtime, snapshot naming, gate).
 * Coupled values — must move together (Code Quality § "Coupled values: shared
 * source at 2 occurrences"). Live in `@fjall/util` so the runtime Docker image
 * picks them up without pulling `aws-cdk-lib`.
 */
/**
 * Snapshot-name prefix shared between the IAM glob in
 * `IRelationalDatabaseBase.getMigrationSnapshotPolicy()` and the runner's
 * `DBSnapshotIdentifier`. Both sites import this so a renamed prefix can't
 * leave the IAM glob granting access to a name the runner no longer emits.
 */
export declare const MIGRATION_SNAPSHOT_NAME_PREFIX: "fjall-premigrate";
/**
 * Container env var name carrying the target database's effective automated
 * backup retention in whole days. Emitted by
 * `RelationalDatabase.getMigrationContributions()` alongside
 * `SNAPSHOT_TARGET_KIND`/`SNAPSHOT_TARGET_ARN`; the runner's prune-on-success
 * step reads it to keep every `fjall-premigrate-*` snapshot younger than the
 * PITR window and delete the rest (newest-N floor applies regardless). Both
 * sides import this name so a rename cannot leave the construct injecting an
 * env the runner no longer reads — which would silently disable age-based
 * pruning (the runner has no default window: it warns and skips the sweep).
 */
export declare const MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV: "MIGRATION_SNAPSHOT_RETENTION_DAYS";
/**
 * Tag key marking an SDK-created RDS snapshot as Fjall's own, with the value
 * naming which mechanism took it. The runner stamps
 * `fjall:snapshotKind=premigrate` on every pre-migration snapshot (via
 * `rdsPreMigrationSnapshotTags`); the webapp posture rules treat any
 * `fjall:`-prefixed key as Fjall-managed, so a marked snapshot stops
 * surfacing as IaC-unmanaged while a hand-taken manual snapshot still does.
 */
export declare const MIGRATION_SNAPSHOT_KIND_TAG_KEY: "fjall:snapshotKind";
/** `MIGRATION_SNAPSHOT_KIND_TAG_KEY` value for runner-taken pre-migration snapshots. */
export declare const MIGRATION_SNAPSHOT_KIND_PREMIGRATE: "premigrate";
/**
 * Container env var name for the schema-version fail-fast gate. Every
 * container of every service whose `connections:` includes a relational DB
 * declaring `migrations:` receives this env baked in at synth time. The
 * booting service reads it at runtime and refuses to start when the actual
 * schema version trails the expected.
 */
export declare const EXPECTED_SCHEMA_VERSION_ENV: "EXPECTED_SCHEMA_VERSION";
/**
 * Sibling env carrying the producing `MigrationsConfig.tool` discriminator
 * (`"prisma" | "custom"`). Emitted alongside `EXPECTED_SCHEMA_VERSION` so the
 * runtime gate can dispatch to the matching consumer-side resolver.
 */
export declare const EXPECTED_SCHEMA_VERSION_TOOL_ENV: "EXPECTED_SCHEMA_VERSION_TOOL";
/**
 * Container env var name for the ClickHouse schema-version fail-fast gate.
 * Sibling to `EXPECTED_SCHEMA_VERSION` (Postgres). Both gates can fire on
 * one service when its `connections:` spans a relational DB AND a CH DB
 * each declaring `migrations:`.
 */
export declare const EXPECTED_CH_SCHEMA_VERSION_ENV: "EXPECTED_CH_SCHEMA_VERSION";
/**
 * Container env / secret names for the ClickHouse schema-admin user contributed
 * by `ClickHouseDatabase`. Injected ONLY into the migration task (the sole
 * DDL principal) — never into app containers, the gate container, or the
 * maintenance sidecars, each of which authenticates as its own workload-class
 * identity (see `clickhouseFrameworkUsers.ts`). One XML principal shared by
 * six holders under a `max_concurrent_queries_for_user = 1` cap was the
 * 2026-08-25 deploy-rollback incident: a gate probe lost the slot to the
 * scheduled OPTIMIZE and reported the server "unreachable".
 */
export declare const SCHEMA_ADMIN_USER_ENV: "SCHEMA_ADMIN_USER";
export declare const SCHEMA_ADMIN_PASSWORD_ENV: "SCHEMA_ADMIN_PASSWORD";
/**
 * Container env / secret names for the materialised schema-gate container
 * (`@fjall/schema-gate`). Injected ONLY into the synthetic `fjall-schema-gate`
 * container by `EcsCompute` (never into app containers — those keep their own
 * connection wiring), read by the gate runner at boot. Coupled values across
 * the construct↔runner package boundary — both sides import these names so a
 * rename cannot leave the construct injecting an env the runner no longer
 * reads (which would surface as exit 2 on every deploy, a wedge class).
 *
 * `SCHEMA_GATE_DB_URL_BASE_ENV` carries `getConnectionString()` output —
 * `<scheme>://<host>:<port>/<dbname>` WITHOUT credentials (SecretValue
 * references cannot be interpolated at synth). The runner composes the final
 * URL from the two Secrets-Manager-backed sibling envs.
 */
export declare const SCHEMA_GATE_DB_URL_BASE_ENV: "FJALL_SCHEMA_GATE_DB_URL_BASE";
export declare const SCHEMA_GATE_DB_USER_ENV: "FJALL_SCHEMA_GATE_DB_USER";
export declare const SCHEMA_GATE_DB_PASSWORD_ENV: "FJALL_SCHEMA_GATE_DB_PASSWORD";
/**
 * ClickHouse connection env names for the materialised gate container's CH
 * half. Coupled values across the construct↔runner boundary like the
 * `SCHEMA_GATE_DB_*` trio above: `EcsCompute` composes `CLICKHOUSE_URL` /
 * `CLICKHOUSE_DATABASE` from the resolved CH database (plus the CA-cert
 * secret import when the database is TLS-fronted) and the gate runner reads
 * the same names at boot. The values are the conventional names app
 * containers already receive from connection wiring — the constants pin the
 * gate contract, they do not rename anything.
 */
export declare const SCHEMA_GATE_CH_URL_ENV: "CLICKHOUSE_URL";
export declare const SCHEMA_GATE_CH_DATABASE_ENV: "CLICKHOUSE_DATABASE";
export declare const SCHEMA_GATE_CH_CA_CERT_ENV: "CLICKHOUSE_CA_CERT";
/**
 * ClickHouse credential env names for the gate container's CH half. The
 * value of `SCHEMA_GATE_CH_USER_ENV` is always `FJALL_SCHEMA_GATE_USER` (the
 * read-only gate identity), and `SCHEMA_GATE_CH_PASSWORD_ENV` is a
 * Secrets-Manager import of that identity's password. Named in the
 * `FJALL_SCHEMA_GATE_*` family alongside the Postgres trio so a reader of the
 * task definition sees one gate contract, not a gate half and a borrowed
 * admin half.
 */
export declare const SCHEMA_GATE_CH_USER_ENV: "FJALL_SCHEMA_GATE_CH_USER";
export declare const SCHEMA_GATE_CH_PASSWORD_ENV: "FJALL_SCHEMA_GATE_CH_PASSWORD";
/**
 * ECS `startTimeout` for the synthetic gate container — the ceiling ECS
 * allows the gate to reach its exit before the task is stopped as a failed
 * start. The gate runner derives its own retry budget FROM this value (it
 * must finish, with a verdict, comfortably inside it), so the two are coupled
 * across the construct↔runner boundary: a construct that raised the timeout
 * without the runner widening its budget would leave headroom unused; a
 * runner budget exceeding the timeout would be cut off mid-retry with no
 * verdict at all. Hoisted so both read one number.
 */
export declare const SCHEMA_GATE_START_TIMEOUT_SECONDS: 120;
/**
 * The synthetic gate container's reserved name. Shared between the construct
 * (container synthesis + the name-collision validator in `validateEcsProps`)
 * and anything that needs to address the container (deploy-time diagnostics,
 * docs examples). Coupled values — a drift renders the collision validator
 * guarding a name the synthesiser no longer emits.
 */
export declare const SCHEMA_GATE_CONTAINER_NAME: "fjall-schema-gate";
/**
 * ECR repository names for the gate runner's OCI image. Coupled values across
 * the construct↔deploy-engine boundary (Code Quality § "Runtime resource names
 * must match the CDK construct's derivation"): `EcsCompute` composes the
 * default container image URI as
 * `<account>.dkr.ecr.<region>.<urlSuffix>/${SCHEMA_GATE_ECR_REPO_NAME}:<exact semver>`
 * while deploy-core's `ensureSchemaGateImage` creates that private repository
 * and mirrors the matching tag into it from `SCHEMA_GATE_PUBLIC_IMAGE_REPO`.
 * The image tag is ALWAYS the exact `@fjall/schema-gate` package semver
 * (lockstep-versioned with the constructs), never `latest` — a construct
 * upgrade must not silently change gate behaviour on redeploys.
 */
export declare const SCHEMA_GATE_ECR_REPO_NAME: "fjall/schema-gate";
export declare const SCHEMA_GATE_PUBLIC_IMAGE_REPO: "public.ecr.aws/fjall/schema-gate";
/**
 * Prisma migration directory pattern: 14-digit timestamp + underscore prefix.
 * Sortable alphanumerically because the timestamp is fixed-width.
 */
export declare const PRISMA_MIGRATION_DIR_RE: RegExp;
/**
 * Files in a ClickHouse migrations dir that `runSqlMigrations` skips by
 * default (dev-only SQL). Shared with `pickLatestClickHouseMigration` so the
 * synth-time gate and the runtime applier agree on which file is "latest" —
 * drift would inject an `EXPECTED_CH_SCHEMA_VERSION` the runner can never
 * record, hard-failing every boot.
 */
export declare const CLICKHOUSE_MIGRATION_SKIP_RE: RegExp;
/**
 * A ClickHouse migration filename — the `.sql` suffix by which
 * `pickLatestClickHouseMigration` / `runSqlMigrations` select the "latest"
 * migration (both `.endsWith(".sql")` then `.sort()`). The boot gate's
 * order-tolerant comparison uses it to tell a monotonically-ordered CH version
 * (`ch_version` = the latest `.sql` filename) from the non-orderable audit
 * fields (`version` = sha256 hash, `prisma_version` = the constant `"applied"`).
 */
export declare const CLICKHOUSE_MIGRATION_FILE_RE: RegExp;