import { type Result } from "@fjall/generator";
import type { DockerBuildSecretRef, DockerBuildArgValue } from "@fjall/util/manifest/schemas";
import type { AwsProvider } from "../../aws/AwsProvider.js";
import type { ResolvedBuildSecret } from "../dockerInterface.js";
import { type BuildSecretSessionContext } from "./buildSecretSession.js";
/**
 * Outcome of resolving a manifest's `docker.buildSecrets` refs. `resolved` is
 * ready to hand to `DockerBuildParams.buildSecrets`; `cleanup()` removes the
 * temp directory holding the 0600 value files and MUST be awaited in a `finally`
 * (wrap the await in `.catch(...)` — a throw from cleanup must not replace the
 * build result).
 */
export interface ResolvedBuildSecrets {
    resolved: ResolvedBuildSecret[];
    cleanup: () => Promise<void>;
}
/**
 * Resolve each build-time secret REFERENCE to its VALUE just-in-time, writing
 * the value to a 0600 temp file and returning a `{ kind: "file", path }` handle
 * for a BuildKit `--secret` mount. The value reaches buildx ONLY via that mount
 * (tmpfs, one `RUN`), never `--build-arg` — so it cannot enter an image layer,
 * `docker history`, or provenance.
 *
 * Fail-CLOSED: an unresolvable ref aborts the build at this cheap pre-build
 * point with a remediation message naming the FIELD/KEY (an identifier — never
 * the value). The resolved value is NEVER logged. On any failure the temp dir
 * is removed before returning.
 *
 * Sources:
 *   - `ssm` → `GetParameter({ WithDecryption: true })`
 *   - `secretsManager` → `GetSecretValue` (by name or ARN; optional JSON `field`)
 *   - `env` → `process.env[name]`, rejecting undefined AND empty string
 */
/**
 * Project the sourced (`ssm` / `secretsManager`) values out of a `buildArgs`
 * map into `DockerBuildSecretRef`s, so the same scoped-session policy covers
 * both the buildArg reads and the build-secret file-mount reads. `env`-sourced
 * and plain-string values contribute nothing — they never touch AWS.
 */
export declare function sourcedRefsFromBuildArgs(buildArgs: Record<string, DockerBuildArgValue> | undefined): DockerBuildSecretRef[];
/**
 * Narrow the AWS identity to a least-privilege build-secret read session when
 * the provider supports it (CLI). When the provider cannot self-scope (the
 * worker's pre-assumed OIDC credentials — `assumeScopedBuildSecretSession`
 * absent) OR no app context is supplied, falls back to the unscoped provider.
 * A policy that is too large to fit the inline limit fails closed here.
 */
export declare function resolveBuildSecretSessionProvider(awsProvider: AwsProvider, refs: readonly DockerBuildSecretRef[], appContext?: BuildSecretSessionContext): Promise<Result<AwsProvider>>;
export declare function resolveBuildSecrets(awsProvider: AwsProvider, refs: readonly DockerBuildSecretRef[], abortSignal?: AbortSignal, appContext?: BuildSecretSessionContext): Promise<Result<ResolvedBuildSecrets>>;
/**
 * Resolve a single secret/sourced REFERENCE to its string VALUE. Shared by the
 * build-secret path (file-mount) and the public-but-sensitive `buildArgs`
 * sourced-value path — both read the same SSM/SM/env sources under the same
 * (ideally scoped) AWS identity. The value is NEVER logged; failures name the
 * identifier only.
 */
export declare function resolveSecretRefValue(awsProvider: AwsProvider, ref: DockerBuildSecretRef, abortSignal?: AbortSignal): Promise<Result<string>>;