/**
 * Azure deep observation (#1086) — the azure row of the deep-observe contract
 * (#1014).
 *
 * `az resource show --resource-group <env> --name <name> --resource-type
 * <type> -o json` already returns the full ARM resource — the same call the
 * thin path (./describe-resources.ts) makes, which keeps `provisioningState`
 * (as `status`) plus `location`/`tags`. The depth is free; the work is
 * entirely normalization, per the issue.
 *
 * ## Why the live tree is flattened, not passed through raw
 *
 * Unlike AWS (whose declared props mirror CloudFormation's vocabulary 1:1, so
 * the Cloud Control payload normalizes and diffs as-is), chant's Azure
 * resource classes do not mirror the ARM response shape verbatim: codegen
 * (`spec/parse.ts`'s `RESOURCE_LEVEL_FIELDS` pass) flattens ARM's `properties`
 * wrapper onto the constructor's top level, so a storage account's declared
 * `minimumTlsVersion` is a sibling of `location`/`tags`, not nested under a
 * `properties` key. Passing the raw `az resource show` response through
 * unflattened would make `properties.minimumTlsVersion` a path with no
 * declared counterpart, ever — the same permanent-noise problem AWS avoids by
 * having a vocabulary match to begin with. So this reader flattens
 * `properties.*` up to the same top level chant's generated classes use,
 * alongside the resource-level fields (`name`, `location`, `sku`, `kind`,
 * `identity`, `tags`, `zones`, `plan`) ARM returns as siblings of `properties`.
 *
 * `id`, `type`, `etag` and `systemData` are the one thing that's *not*
 * flattened in — they have no declared counterpart of any kind (chant's
 * codegen skips `type`/`apiVersion` explicitly, and `id`/`etag`/`systemData`
 * are pure ARM-envelope bookkeeping), so they are simply never read into the
 * tree, the same way `type`/`physicalId` live outside `properties` on {@link
 * DeepResourceObservation} rather than inside it.
 *
 * ## Scope
 *
 * Same as the thin path: any top-level ARM type (`Microsoft.<provider>/<kind>`,
 * exactly one `/`) is readable; a nested compound type
 * (`Microsoft.Storage/storageAccounts/blobServices`) is `unsupported-kind`,
 * because `az resource show` does not accept a compound type name either.
 * Deferred, not fixed, here — same as the issue's own "worth fixing here or
 * explicitly deferring" — widening it is additive and needs no contract change.
 *
 * ## Nothing here talks to real Azure on its own terms
 *
 * ARM over the applier's own transport (`./api/read-client.ts`), exactly like
 * the thin path (#1212) — no CLI, no ARM SDK, no ambient token. The payload is
 * the same ARM JSON `az resource show` was relaying, so the normalization below
 * is untouched by the move.
 */
import { type AzHttp } from "./op/activities/az-apply.js";
import type { DeepNormalizationHooks, DeepObservationResult } from "@intentius/chant/lexicon";
/**
 * Server-populated wherever they appear — matched on the final path segment,
 * the same technique AWS's `AWS_READ_ONLY_NAMES` uses, because ARM repeats
 * `provisioningState` at every resource-properties depth and a per-type list
 * of full paths would be a maintenance trap. Deliberately excludes ambiguous
 * names like `id`/`name`: a subnet's `properties.routeTable.id` is a declared
 * cross-reference, and pruning it is how a normalization pass starts hiding
 * real drift. (The resource's *own* envelope `id` is handled separately —
 * see the module doc — precisely so this list never has to touch `id` at all.)
 */
export declare const AZURE_READ_ONLY_NAMES: ReadonlySet<string>;
/**
 * Server-computed surfaces ARM fills in on its own (#1214, the AKS row of the
 * CC round-trip): a managed cluster always comes back with `fqdn`,
 * `currentKubernetesVersion` and `nodeResourceGroup` whether or not the
 * declaration said anything about them. Unlike `AZURE_READ_ONLY_NAMES` these
 * are counterpart-gated rather than pruned outright: `nodeResourceGroup` IS
 * declarable at create time, so a declared value is still compared — only the
 * purely server-filled appearance is noise. Sparse and evidence-based, like
 * `AZURE_SERVICE_DEFAULTS`.
 */
export declare const AZURE_SERVER_COMPUTED_NAMES: ReadonlySet<string>;
/**
 * ARM service defaults, per type, as index-erased property paths. Subtracted
 * only where source never declared the property — cdk-real-drift's default
 * subtraction, same as AWS's `AWS_SERVICE_DEFAULTS`. Sparse and evidence-based
 * rather than exhaustive across 1900+ ARM types: widening this table is
 * additive and needs no contract change.
 */
export declare const AZURE_SERVICE_DEFAULTS: Record<string, Record<string, unknown>>;
/**
 * The azure lexicon's noise rules. Three classes, same as AWS: server-
 * populated fields (by name, unconditional), controller-injected boilerplate
 * (by name, unconditional), and ARM service defaults (gated on
 * `counterpart === "absent"`) — plus tag-map defaults, which AWS has no
 * equivalent for since its `Tags` is an array rather than a plain object (an
 * ARM tag map's key order is already canonicalized unconditionally by core,
 * since it is a plain object; only the *default empty map* needs a rule here).
 */
export declare const azureDeepNormalizationHooks: DeepNormalizationHooks;
export interface AzureDeepObserveOptions {
    /** Injectable transport, mirroring `azApply`'s — tests reach the reader with no network. */
    http?: AzHttp;
    environment: string;
    entityNames: string[];
    entities: Map<string, {
        entityType: string;
        props: Record<string, unknown>;
    }>;
}
/**
 * Read the live property tree for each declared entity via `az resource
 * show`. One call per entity, same as the thin path — ARM has no bulk
 * "describe everything in this group" call with per-resource depth the way
 * CloudFormation's `describe-stack-resources` does, so there is no cheap
 * list-then-describe split to make here the way AWS's or temporal's readers
 * do.
 */
export declare function observeResourcesDeepAzure(options: AzureDeepObserveOptions): Promise<DeepObservationResult>;
//# sourceMappingURL=deep-observe.d.ts.map