/**
 * A managed resource's own properties (#1279).
 *
 * `describe-stack-resources` returns identity and status — logical id, physical
 * id, type, timestamp — and nothing about the resource itself. So the managed
 * observation filled `attributes` with the *stack's* outputs instead, copied
 * onto every resource in the stack. Every node in a stack came out carrying the
 * same `expVpcId`/`expWebIp` keys, and no node carried its own `VpcId`.
 *
 * That is invisible until something asks. `search --show VpcId` printed a blank
 * column for six instances, which reads as "the estate has no VPCs" rather than
 * "chant never read that". An agent asked which instances were outside the
 * default VPC concluded all six were, because nothing in the graph said
 * otherwise.
 *
 * A deep read (Cloud Control) answers this properly but is a per-resource call
 * and is not available on every endpoint. This is the cheap middle: one describe
 * per kind for the whole observation, joined back by physical id. Stack outputs
 * no longer ride the resource at all — they are the stack's, and travel on the
 * observation envelope's `stackExports`. Whatever a resource already carries is
 * kept underneath its own properties, which win a name collision because they
 * are the resource's.
 */
import type { ResourceMetadata } from "@intentius/chant/lexicon";
/**
 * Stamp the region each resource was observed in (#1279).
 *
 * The observation is already scoped per stack and each stack declares its
 * region, so the reader knows this and was throwing it away. Without it the
 * only route to "which region is this in" was parsing
 * `Placement.AvailabilityZone` and trimming the last character — a trick that
 * happens to work for EC2 and for nothing else. Region is a dimension of the
 * estate, not a substring of an availability zone.
 */
export declare function stampRegion(resources: Record<string, ResourceMetadata>, region?: string): Record<string, ResourceMetadata>;
/** True when this lexicon can read the kind's own properties. */
export declare function canDescribe(kind: string): boolean;
/** What an enrichment pass managed to do, so a caller can tell a miss from a no-op. */
export interface OwnPropertiesResult {
    resources: Record<string, ResourceMetadata>;
    /**
     * True when enrichment was attempted and *every* kind's read failed — the
     * transport is unavailable rather than the account being quiet. Callers must
     * not present the result as a complete observation (#1089).
     */
    transportFailed: boolean;
    /** Why each failed kind failed, keyed by CloudFormation type, so a caller can attribute per resource. */
    failures: Map<string, string>;
}
/**
 * Merge each resource's own properties into an observation, in place of nothing.
 *
 * Best-effort per kind: an endpoint that cannot answer `describe-subnets` still
 * yields instance properties. A miss costs detail — with one exception that used
 * to be silent and is now reported.
 *
 * The exception (#1206): these attributes are compared by `lifecycle diff`, so a
 * read that fails after the resource is already identified does not degrade to
 * "less detail", it degrades to *drift* — the snapshot has `GroupId`, the live
 * read has nothing, and the differ reports the property as removed. A partial
 * failure still rides the best-effort path, but a total one is a hole the caller
 * has to declare rather than a thinner set of facts.
 */
export declare function describeOwnProperties(resources: Record<string, ResourceMetadata>, region?: string): Promise<OwnPropertiesResult>;
//# sourceMappingURL=properties.d.ts.map