import type { GraphIR } from "./graph-ir.js";
/**
 * Fold DERIVED reachability facts onto EC2 instance nodes so a single-node query
 * can answer questions that are otherwise a multi-hop join with a union (#1139).
 *
 * Two facts, both things a live AWS-CLI sweep gets wrong because it can't cheaply
 * resolve the topology:
 *
 *  - `effectiveIngress` — the union of security-group ingress rules reachable
 *    from the instance, BOTH directly (`SecurityGroupIds`) AND through its launch
 *    template (`LaunchTemplate → LaunchTemplateData → SecurityGroupIds`). The
 *    launch-template hop is exactly what a CLI agent misses (it under-counts
 *    SSH-reachable instances). Each rule is normalized to `proto:port:cidr`
 *    (e.g. `tcp:22:0.0.0.0/0`) so it is precisely queryable.
 *  - `internetFacing` — whether the instance's subnet routes to an Internet
 *    Gateway (`subnet ← SubnetRouteTableAssociation → RouteTable ← Route →
 *    InternetGateway`). "Public subnet" means an IGW route, not
 *    `MapPublicIpOnLaunch`.
 *
 * With these, "instances SSH-reachable from the internet" is one predicate:
 *   `kind:EC2::Instance attr:internetFacing=true attr:effectiveIngress=tcp:22:0.0.0.0/0`
 * — no hand-joined CLI sweep, no over/under-counting.
 */
export declare function enrichEffectiveTopology(ir: GraphIR): GraphIR;
//# sourceMappingURL=graph-effective.d.ts.map