/**
 * Live introspection of an Azure resource group over ARM (#1212).
 *
 * For each declared Azure entity, GETs
 *   {endpoint}/subscriptions/{sub}/resourceGroups/{env}/providers/{type}/{name}
 *
 * on the applier's own transport (`./api/read-client.ts`, which is
 * `az-apply.ts`'s client pointed at the read side) rather than shelling
 * `az resource show`. The payload is the same ARM JSON either way — the CLI was
 * only ever relaying it — so this is transport, not translation: no CLI to
 * spawn, reads that run concurrently, failures carrying ARM's own error code,
 * and an emulator override that reaches floci-az the same way every other
 * lexicon's does.
 *
 * The response maps to a ResourceMetadata entry keyed by chant entity name
 * (using props.name from #39's entity-prop pass-through). The environment
 * argument is treated as the Azure resource group name.
 *
 * Resource-not-found is an absence — `state diff --live` then reports it as
 * missing. Nested resource types (e.g.
 * `Microsoft.Storage/storageAccounts/blobServices`) are NOT-OBSERVED
 * (`unsupported-kind`, #1089): `az resource show` doesn't accept a compound
 * type, so chant never asks, and a blob service that already exists must not
 * come back as a proposed `create`. Auth failures and unreachable subscriptions
 * are holes for the same reason.
 */
import type { ObservationResult, UnobservedReason } from "@intentius/chant/lexicon";
import type { AzHttp } from "./op/activities/az-apply.js";
/**
 * Top-level ARM type — i.e. exactly one `/` separating provider from kind.
 * Nested types like `Microsoft.Storage/storageAccounts/blobServices` need a
 * different query path that this implementation doesn't yet support.
 *
 * Exported so the deep reader (./deep-observe.ts, #1086) applies the exact
 * same scope limit — a nested type is `unsupported-kind` at both depths, not
 * silently deeper on one and not the other.
 */
export declare function isTopLevelType(entityType: string): boolean;
/**
 * Classify an `az resource show` failure (#1089). Only the CLI's explicit
 * not-found establishes absence; everything else — an expired login, a
 * subscription that can't be resolved, a network failure — proves nothing.
 */
export declare function classifyAzFailure(err: unknown): {
    absent: true;
} | {
    absent: false;
    reason: UnobservedReason;
    detail: string;
};
/**
 * Classify an ARM failure off its own error code (#1212).
 *
 * The CLI classifier above matched on prose because stderr was all it had.
 * ARM sends `{ error: { code, message } }`, so the code is the signal and the
 * message is only for the human — the same distinction the AWS read client
 * makes. Kept beside `classifyAzFailure` rather than replacing it: the CLI
 * path still exists for a signed read against real ARM.
 */
export declare function classifyArmFailure(err: unknown): {
    reason: UnobservedReason;
    detail: string;
};
export declare function describeResources(options: {
    environment: string;
    buildOutput: string;
    entityNames: string[];
    entities: Map<string, {
        entityType: string;
        props: Record<string, unknown>;
    }>;
    /** Injectable transport, mirroring `azApply`'s — tests reach the reader with no network. */
    http?: AzHttp;
}): Promise<ObservationResult>;
//# sourceMappingURL=describe-resources.d.ts.map