/**
 * Deep-read sources for the EC2 topology types (#1269).
 *
 * chant's distinguishing answers are folds over topology: `internetFacing`
 * resolves subnet -> route table -> internet gateway, `effectiveIngress`
 * resolves rules across attached security groups, and the default-VPC
 * classification (`defaults.ts`) reads the provider's own markers. The inputs
 * to all of them are the types this file covers — with only the original four
 * kinds readable, a deep snapshot of an EC2 estate carried almost no
 * properties, and a snapshot-backed query could answer identity questions but
 * not a single fold question.
 *
 * Two sources, chosen per type:
 *
 * - The container types (VPC, subnet, route table, internet gateway) read
 *   through the EC2 describes. The fold facts live there and nowhere else:
 *   `IsDefault`, `DefaultForAz` and a subnet's live `MapPublicIpOnLaunch` are
 *   not part of the CloudFormation resource model, so Cloud Control cannot
 *   report them. The describes are also bulk (one call per type for the whole
 *   stack) and are implemented by the emulators that do not serve Cloud
 *   Control's `GetResource`.
 *
 * - The join types (route, association, gateway attachment) and the two whose
 *   describes do not fit a flat bulk join (instance rows nest inside
 *   reservations; launch-template data lives in a separate versions call) read
 *   through Cloud Control, which returns their model in the declared side's
 *   own shape.
 *
 * Each type carries its normalization entries alongside (#1269's note: adding
 * a type without them trades a hole for a false positive, which is worse).
 * They are merged into the tables in `deep-observe.ts`.
 */
import type { DeepSource } from "./deep-observe.js";
/**
 * `describe-vpcs` -> the `AWS::EC2::VPC` resource model, plus `IsDefault`.
 *
 * `IsDefault` is the provider's own marker for the VPC nobody wrote — the fact
 * the default classification reads — and it exists only on this surface.
 * Carried even though the model does not name it; the diff subtracts it as a
 * service default (`false`, gated on source silence) so a CloudFormation-made
 * VPC does not report it as undeclared drift.
 */
export declare function vpcToModel(row: Record<string, unknown>): Record<string, unknown>;
/**
 * `describe-subnets` -> the `AWS::EC2::Subnet` resource model, plus
 * `DefaultForAz`.
 *
 * `MapPublicIpOnLaunch` is half of `internetFacing`; `DefaultForAz` is the
 * provider's default-subnet marker, off the model for the same reason as a
 * VPC's `IsDefault` and handled the same way.
 */
export declare function subnetToModel(row: Record<string, unknown>): Record<string, unknown>;
/**
 * `describe-route-tables` -> the `AWS::EC2::RouteTable` resource model.
 *
 * The row also carries `Routes` and `Associations`, and this mapping drops
 * them on purpose: a template declares each route as its own
 * `AWS::EC2::Route` and each association as its own
 * `AWS::EC2::SubnetRouteTableAssociation`, both covered below, so carrying
 * them here would report every declared route twice — once as an undeclared
 * array on the table and once through its own resource.
 */
export declare function routeTableToModel(row: Record<string, unknown>): Record<string, unknown>;
/** `describe-internet-gateways` -> the `AWS::EC2::InternetGateway` model, which is tags and nothing else. */
export declare function internetGatewayToModel(row: Record<string, unknown>): Record<string, unknown>;
/**
 * The topology types' entries for `DEEP_SOURCES`.
 *
 * The routing-chain joins are addressed by their physical id — for a
 * registry-backed type CloudFormation's physical id *is* the Cloud Control
 * identifier (`rtb-…|0.0.0.0/0` for a route) — so Cloud Control's
 * one-get-per-resource shape fits them exactly and returns the declared
 * model's own field names.
 */
export declare const EC2_TOPOLOGY_SOURCES: Record<string, DeepSource>;
/**
 * Service defaults for the topology types, merged into
 * `AWS_SERVICE_DEFAULTS`. Subtracted on the live side only where source never
 * declared the property — which is how the fold facts (`IsDefault`,
 * `DefaultForAz`, a live `MapPublicIpOnLaunch`) stay in the snapshot for a
 * query to read while never surfacing as drift on a resource CloudFormation
 * itself created.
 */
export declare const EC2_TOPOLOGY_SERVICE_DEFAULTS: Record<string, Record<string, unknown>>;
/**
 * Values the service picks when the template does not supply one, merged into
 * `AWS_GENERATED_NAMES`. A subnet that names no availability zone gets one
 * assigned — a different one is real placement drift only when the template
 * had an opinion, which is exactly the counterpart gate.
 */
export declare const EC2_TOPOLOGY_GENERATED_NAMES: Record<string, ReadonlySet<string>>;
/**
 * Declared properties a type's source cannot see (#1269).
 *
 * `describe-vpcs` does not return the DNS attributes — they live behind
 * `describe-vpc-attribute` — and neither describe returns the IPAM inputs,
 * which are consumed at creation. A declared value for one of these has
 * nothing live to stand against, so the diff would report `value -> <absent>`
 * on every clean apply: a blind spot rendered as drift. Pruned on the
 * declared side, and only where the live tree is silent, so a source that
 * does report the field (Cloud Control, some day) is still compared.
 */
export declare const AWS_DEEP_BLIND_SPOTS: Record<string, ReadonlySet<string>>;
//# sourceMappingURL=deep-topology.d.ts.map