import { type SpecPin } from "./pin.js";
/**
 * Top-level CloudFormation Registry JSON Schema for a single resource type.
 */
export interface CFNSchema {
    typeName: string;
    description?: string;
    properties?: Record<string, SchemaProperty>;
    definitions?: Record<string, SchemaDefinition>;
    required?: string[];
    readOnlyProperties?: string[];
    createOnlyProperties?: string[];
    writeOnlyProperties?: string[];
    primaryIdentifier?: string[];
    deprecatedProperties?: string[];
    conditionalCreateOnlyProperties?: string[];
    replacementStrategy?: string;
    tagging?: {
        taggable?: boolean;
        tagOnCreate?: boolean;
        tagUpdatable?: boolean;
        cloudFormationSystemTags?: boolean;
        tagProperty?: string;
    };
    additionalProperties?: boolean;
}
/**
 * A single property in a CloudFormation Registry schema.
 */
export interface SchemaProperty {
    type?: string | string[];
    description?: string;
    enum?: string[];
    $ref?: string;
    items?: SchemaProperty;
    properties?: Record<string, SchemaProperty>;
    oneOf?: unknown[];
    anyOf?: unknown[];
    required?: string[];
    pattern?: string;
    minLength?: number;
    maxLength?: number;
    minimum?: number;
    maximum?: number;
    format?: string;
    const?: unknown;
    default?: unknown;
}
/**
 * A named type within the definitions section.
 */
export interface SchemaDefinition {
    type?: string | string[];
    description?: string;
    enum?: string[];
    properties?: Record<string, SchemaProperty>;
    required?: string[];
    items?: SchemaProperty;
}
/** `<first 12 digest hex>.zip` — the asset (and local cache) name for a pin. */
export declare function pinAssetName(pin?: SpecPin): string;
/** Public, unauthenticated download URL for a pin's asset. */
export declare function pinAssetUrl(pin?: SpecPin): string;
/** Injectable downloader, so tests never reach the network. Returns undefined on any failure — the caller falls back to the live fetch. */
export type PinAssetDownloader = (url: string) => Promise<Buffer | undefined>;
/**
 * Load and verify the pinned spec: the local verified cache first, then the
 * release asset. Returns undefined when neither is available (offline and
 * cold, or the accept never uploaded) — the caller falls back to the live
 * fetch and the pin's existing advisory drift report. Content that does not
 * digest to the pin throws: a tampered or half-uploaded asset must never
 * silently pass as the accepted spec, wherever it came from.
 */
export declare function loadPinnedSchemas(options?: {
    pin?: SpecPin;
    cacheDir?: string;
    download?: PinAssetDownloader;
}): Promise<Map<string, Buffer> | undefined>;
/**
 * Fetch the CloudFormation Registry schema zip and extract per-resource JSON schemas.
 * Returns a Map keyed by typeName (e.g. "AWS::S3::Bucket") to raw JSON bytes.
 *
 * chant #1511 — the pinned release asset is the primary source: when it
 * resolves and digest-verifies, generation uses the content a human accepted
 * rather than whatever upstream variant this fetch happens to hit, so every
 * build (CI, prepack, publish) is deterministic. The live fetch remains for:
 * `force`, the accept flow (`CHANT_ACCEPT_AWS_SPEC=1`, which must sample
 * upstream — and bypasses the 24h cache for the same reason), and when the
 * asset is unreachable. The live path keeps its 24h local cache.
 *
 * chant #1481 — the fallback is what made two workflows disagree about one
 * commit. The live archive is served from CloudFront and two fetches seconds
 * apart can get different variants; under the release gate, building from
 * it would ship a surface nobody reviewed on a retry lottery, so the gate
 * refuses instead. Anywhere else the fallback stays, but says so, because a
 * silent fallback is indistinguishable from the pinned path in a CI log.
 */
export declare function fetchSchemaZip(force?: boolean, options?: {
    env?: NodeJS.ProcessEnv;
    download?: PinAssetDownloader;
    pinCacheDir?: string;
}): Promise<Map<string, Buffer>>;
/**
 * Get the cache file path (for testing)
 */
export declare function getCachePath(): string;
/**
 * Clear the cache (for testing)
 */
export declare function clearCache(): void;
//# sourceMappingURL=fetch.d.ts.map