/**
 * Live introspection of Fly (flaps) resources — the read-back seam for chant's
 * plan/drift machinery (#767).
 *
 * The write path (flyApply, #739/#741) already GETs live state to decide
 * create/update/noop and to prune owned orphans. This surfaces that same read
 * side through the standard `describeResources` seam so core's change set
 * (packages/core/src/lifecycle/change-set.ts) and `chant lifecycle plan` can see
 * live Fly state and classify create/update/delete/adopt/noop.
 *
 * Peer of gcp/aws describe-resources: list what is live, key it by chant entity
 * name, attach an ownership verdict. Two-tier ownership, matching the applier
 * (#743):
 *
 *   - Machines carry the primary marker (`managed-by: chant`,
 *     FLY_METADATA_OWNERSHIP_KEYS), so their verdict is per-resource: `owned`
 *     when `isChantOwned(config.metadata)`, else `foreign`.
 *   - Volumes, IPs, and certificates carry no marker channel, so their boundary
 *     is the app (#741/#743): everything under a chant-managed app (one carrying
 *     the marker via its machines) is `owned`. When the `owned` filter asks for
 *     those types, this logs that ownership is inferred at the app boundary
 *     rather than silently returning everything, per the seam contract.
 *
 * Endpoint + auth reuse the applier verbatim (resolveEndpoint /
 * FLY_FLAPS_BASE_URL / FLY_API_TOKEN), so plan reads the same mudflaps or
 * real-Fly target flyApply writes. Secrets are apply-only (D7): flaps returns
 * only a digest, so they never enter a diff and are excluded here.
 */
import type { ObservationResult, ResourceMetadata } from "@intentius/chant/lexicon";
import { type ChangeSet } from "@intentius/chant/lifecycle/change-set";
import { type FlyHttp } from "./op/activities/fly-apply.js";
export interface DescribeResourcesOptions {
    environment: string;
    buildOutput: string;
    entityNames: string[];
    entities: Map<string, {
        entityType: string;
        props: Record<string, unknown>;
    }>;
    /** Restrict to chant-owned resources (#119). */
    owned?: boolean;
    /** flaps endpoint override (tests). Defaults to resolveEndpoint() → FLY_FLAPS_BASE_URL. */
    endpoint?: string;
}
/**
 * List live Fly resources over flaps and return them keyed by chant entity name,
 * each tagged with an ownership verdict the core change set reads to decide
 * whether an orphan is a delete (owned) or an adopt candidate (foreign). Reused
 * by `flyPlugin.describeResources`.
 *
 * `http` is injectable for tests; the default reuses the applier's fetch client
 * (bearer token from FLY_API_TOKEN).
 */
export declare function describeResources(options: DescribeResourcesOptions, http?: FlyHttp, signal?: AbortSignal): Promise<ObservationResult>;
/**
 * Read-only plan (#767 §4): a `flyApply` dry-run. Reads live state via
 * {@link describeResources}, promotes it to core's typed change set, then
 * refines each declared+live machine's update/noop verdict with the applier's
 * own `configEqual`, so the plan matches exactly what a subsequent `flyApply`
 * would do — never mutating. `renderChangeSet` gives the human view.
 *
 * The core change set already computes create/delete/adopt/noop from
 * declared-vs-live + ownership; the `configEqual` refinement adds the
 * declared-vs-live *config* comparison for machines (core's own update signal is
 * snapshot-relative, which a stateless dry-run has no snapshot for).
 */
export declare function flyPlan(options: DescribeResourcesOptions & {
    /** Previous snapshot resources, when reconciling drift since a snapshot. */
    observedThen?: Record<string, ResourceMetadata>;
}, http?: FlyHttp, signal?: AbortSignal): Promise<{
    changeSet: ChangeSet;
    rendered: string;
}>;
//# sourceMappingURL=describe-resources.d.ts.map