/**
 * The consent lines a create flow shows for a tier (alert policy design
 * § 13.10): for the backup tier a chosen tier implies, the K1 rows the tier
 * leaves at the default that produces the finding — so the create-app
 * wizard and `fjall create` say, before the app exists, what the first
 * posture scan will list and where. Derived from the registry and from the
 * tier table the constructs read, so the wizard, the CLI, the scan and the
 * deploy cannot disagree; the words are built here once so the two clients
 * print them byte-identically. It informs the choice and gates nothing.
 * Client-safe: the tier table is zod-only.
 */
import { type BackupTier } from "../backupTiers.js";
import { type ExpectedPolicyRow } from "./registry.js";
import type { PolicyResourceFootprint } from "./resourceKinds.js";
/**
 * The K1 rows a backup tier leaves at the default that produces the finding,
 * on a resource the workload synthesises, in registry order. An undefined
 * tier reads the `standard` column, as the constructs do. Only rows keyed on
 * the backup tier are lines: creating the app is what produces them. A row
 * on another knob — the alarm topic's account-level `alarmTopicEncryption`,
 * scoped to the Account's own construct — is produced by the account, not
 * by the app being created, so it is not a line at any tier. And only rows
 * whose `kind` is in the footprint — the CloudFormation resource types the
 * plan or the pattern produces, projected onto `POLICY_RESOURCE_KINDS` — are
 * lines: an app with no topic is not told about the topic row, a pattern
 * with no cluster not about Container Insights. The footprint is required,
 * not defaulted: an unknown footprint is not an empty one, so a caller that
 * cannot derive it fails typecheck rather than list nothing.
 */
export declare function expectedRowsAtDefault(backupTier: BackupTier | undefined, footprint: PolicyResourceFootprint, registry?: readonly ExpectedPolicyRow[]): ExpectedPolicyRow[];
/** One line of the note: the cause, the finding as it is listed, and the registry's own expectation words. */
export interface TierConsentLine {
    /** `policyRowKey` of the expected row: the line's identity. */
    rowKey: string;
    ruleId: string;
    /**
     * The finding as the scan lists it: the rule's title where the caller
     * holds the rule registry (the webapp wizard), else the rule id (the CLI).
     */
    title: string;
    /** The knob and the construct it sits on, as the asset page groups the finding. */
    cause: string;
    expectation: string;
}
export declare function tierConsentLine(row: ExpectedPolicyRow, title: string): TierConsentLine;
/**
 * Where the lines land, in the words the scan uses: the expected-lane stages
 * and the status-label table's clauses, under the organisation's posture
 * setting — the scan's ladder flags on a strict organisation before it
 * looks at the stage, so a strict organisation is told `open` everywhere.
 * `null` is a posture setting the caller could not read; the clause says so
 * rather than promise either lane. Rendered once as the note's lead,
 * because every K1 row shares the one lane rule.
 */
export declare function expectedLaneWhereClause(postureStrict: boolean | null): string;
/** The note's name: the wizard panel's accessible name and the CLI note's heading. */
export declare const TIER_CONSENT_NOTE_LABEL = "Posture findings this tier produces";
/**
 * The note's lead in three parts, so a renderer may emphasise the tier name
 * between them: "Choosing <tier> keeps these defaults, and the first posture
 * scan lists them. <where the scan lists them> Nothing is accepted on your
 * behalf." The where-clause is `expectedLaneWhereClause`.
 */
export interface TierConsentLead {
    prefix: string;
    tierName: string;
    rest: string;
}
export declare function tierConsentLead(tierName: string, postureStrict: boolean | null): TierConsentLead;