/**
 * Extract required SSM secret paths from the Fjall manifest.
 *
 * Reads `fjall-manifest.json` from the given cdk.out directory and
 * collects all `ssmSecretsPath/secretName` entries from ECS services
 * and Lambda functions.
 *
 * Returns an empty array if the manifest does not exist, cannot be
 * parsed, or contains no secrets. Never throws.
 */
export declare function parseRequiredSecretsFromManifest(cdkOutPath: string): string[];
/**
 * Extract name-form Secrets Manager imports from the Fjall manifest.
 *
 * Reads `fjall-manifest.json` and collects every `importedSecretNames` entry
 * from ECS services and Lambda functions — the externally-managed secrets the
 * construct declared `secretsImport: { id, name }` for. deploy-core resolves
 * each to its complete ARN via DescribeSecret and re-injects them as CDK
 * context so the construct renders an authorising complete-ARN `valueFrom`.
 *
 * Source-driven, not template-scanning: the name is read from the declared
 * import, so it is found regardless of how CDK renders the suffixless ARN — a
 * plain string in an env-bound stack (concrete account+region) or an Fn::Join
 * in a token-env stack. The arn-form escape hatch never reaches this field (the
 * synth-time writer excludes it), so a cross-account complete ARN is never
 * handed to the fail-closed resolver.
 *
 * Returns an empty array if the manifest does not exist, cannot be parsed, or
 * declares no imports. Never throws.
 */
export declare function parseImportedSecretNamesFromManifest(cdkOutPath: string): string[];