/**
 * What an AWS estate depends on but does not declare (#1273).
 *
 * `describeResources` is scoped to the stack. An instance placed in the
 * account's default VPC routes through a route table nobody declared, so that
 * table is never observed, never a node, and no fold can traverse to it. The
 * answer used to be computed inside the lexicon and injected as an attribute —
 * which is a conclusion no snapshot can record enough to recompute.
 *
 * This reports the resources instead, so the one graph fold derives the answer.
 *
 * The closure is bounded: start from the observed instances, follow the
 * reference chain the catalog declares as meaningful — subnet, then route
 * table, then gateway — and stop. Anything not reached from a declared resource
 * along a declared reference is not a dependency, it is just the account.
 */
import type { DependencyObservation, ResourceMetadata } from "@intentius/chant/lexicon";
/** One ingress permission as `describe-security-groups` returns it. */
interface RawIpPermission {
    IpProtocol?: string;
    FromPort?: number;
    ToPort?: number;
    IpRanges?: Array<{
        CidrIp?: string;
        Description?: string;
    }>;
    Ipv6Ranges?: Array<{
        CidrIpv6?: string;
        Description?: string;
    }>;
    UserIdGroupPairs?: Array<{
        GroupId?: string;
        Description?: string;
    }>;
}
/**
 * Flatten `IpPermissions` into the CloudFormation-shaped rules the fold reads.
 *
 * The two AWS surfaces disagree about the same concept: a template's
 * `SecurityGroupIngress` carries `CidrIp` flat on the rule, while
 * `describe-security-groups` nests sources under `IpRanges[]`, `Ipv6Ranges[]`
 * and `UserIdGroupPairs[]`, and one permission can hold several. Handing the
 * describe shape to the fold unchanged yields a rule with no recognisable
 * source, which `normalizeIngress` renders as `?` — an ingress rule that
 * matches no CIDR query and quietly narrows the answer.
 *
 * One rule per source, because that is what the flat shape means.
 */
export declare function toIngressRules(permissions: RawIpPermission[]): Array<Record<string, unknown>>;
/**
 * Read the routing an observed estate depends on.
 *
 * Only the tables that actually serve an observed instance are reported: one
 * reached by an explicit subnet association, or the VPC's main table standing in
 * for a subnet with none. A route table serving nothing chant deployed is not a
 * dependency of this estate.
 */
export declare function observeAwsDependencies(options: {
    observed: Record<string, ResourceMetadata>;
    region?: string;
}): Promise<DependencyObservation>;
export {};
//# sourceMappingURL=dependencies.d.ts.map