/**
 * Shared utility for extracting CloudFormation resource references
 * from template properties.
 *
 * Used by WAW010 (redundant DependsOn) and COR020 (circular deps).
 */
/**
 * Parsed CloudFormation template structure.
 */
export interface CFTemplate {
    AWSTemplateFormatVersion?: string;
    Resources?: Record<string, CFResource>;
    [key: string]: unknown;
}
export interface CFResource {
    Type: string;
    Properties?: Record<string, unknown>;
    DependsOn?: string | string[];
    [key: string]: unknown;
}
/**
 * Parse a serialized CloudFormation template from build output.
 * Accepts either a raw string or a SerializerResult (extracts primary).
 */
export declare function parseCFTemplate(output: string | {
    primary: string;
}): CFTemplate | null;
/**
 * Recursively walk a CloudFormation property value and extract all logical IDs
 * referenced via Ref and Fn::GetAtt.
 *
 * Skips pseudo-parameters (those starting with "AWS::").
 */
export declare function findResourceRefs(value: unknown): Set<string>;
/**
 * Build the reverse of `findResourceRefs` for a whole template: logical id →
 * the set of logical ids whose Properties reference it via Ref/Fn::GetAtt.
 * Lets a check walk the graph consumer-ward (who uses this role?) instead of
 * dependency-ward. Used by WAW059.
 */
export declare function buildReverseRefIndex(template: CFTemplate): Map<string, Set<string>>;
/**
 * Check if a value is a CloudFormation intrinsic function (Ref, Fn::*, etc.)
 * that cannot be statically evaluated.
 */
export declare function isIntrinsic(value: unknown): boolean;
/**
 * Walk IAM policy statements from a resource's properties.
 * Handles IAM::Policy, IAM::Role, and IAM::ManagedPolicy layouts.
 */
export declare function walkPolicyStatements(resource: CFResource): Array<Record<string, unknown>>;
/**
 * Normalize security group ingress rules from inline SecurityGroupIngress
 * property and standalone SecurityGroupIngress resources.
 */
export declare function getSecurityGroupIngress(resource: CFResource): Array<Record<string, unknown>>;
/**
 * Extract an ECS TaskDefinition's container definitions (shared by the
 * WAW046/047/048 ECS checks).
 */
export declare function getContainerDefinitions(resource: CFResource): Array<Record<string, unknown>>;
/**
 * Whether a build's `env` (from `--env` or the project's `ownership.env`, see
 * PostSynthContext#env and #201) should be treated as the strict "full"/
 * production tier for tier-gated checks, vs a relaxed "light" tier acceptable
 * for local/Floci-style stacks. Reuses the existing `ctx.env` seam — no new
 * tier field. An undefined or unrecognized env is treated as non-strict so a
 * project that never sets `--env`/`ownership.env` isn't unexpectedly hard-failed.
 */
export declare function isFullTierEnv(env: string | undefined): boolean;
/**
 * Parse an IPv4 CIDR literal ("10.0.0.0/16") into its numeric base address
 * and prefix length. Returns null for anything that isn't a plain IPv4 CIDR
 * (IPv6, malformed octets, out-of-range prefix) — callers treat that as
 * "can't prove statically" rather than an error.
 */
export declare function parseIpv4Cidr(cidr: string): {
    base: number;
    prefix: number;
} | null;
/**
 * Whether `inner` (an IPv4 CIDR literal) falls entirely within `outer`.
 * Returns null — not false — when either literal isn't a plain, parseable
 * IPv4 CIDR (e.g. IPv6, or a CloudFormation intrinsic already stringified
 * elsewhere); a null means "statically unprovable", not "violation".
 */
export declare function ipv4CidrContains(outer: string, inner: string): boolean | null;
/**
 * Check if a port range [fromPort, toPort] contains any of the sensitive ports.
 */
export declare function portRangeContainsSensitive(fromPort: unknown, toPort: unknown, sensitivePorts: number[]): boolean;
//# sourceMappingURL=cf-refs.d.ts.map