import { type Result } from "@fjall/generator";
import type { AwsProvider } from "../aws/AwsProvider.js";
/**
 * Resolve each externally-managed secret NAME to its COMPLETE ARN (with the AWS
 * 6-char suffix) via DescribeSecret. The complete ARN is what
 * `Secret.fromSecretCompleteArn` needs to render a plain-string `valueFrom` and an
 * exact-ARN `grantRead` — the only shape real Secrets Manager authorises at ECS
 * task launch (the suffixless `fromSecretNameV2` shape is AccessDenied regardless
 * of grant width: the 2026-06-04 outage).
 *
 * Fail-CLOSED: a missing secret or a DescribeSecret AccessDenied aborts the deploy
 * at this cheap pre-synth point, NEVER silently falling back to the suffixless
 * shape. This deliberately inverts the non-fatal IPAM-pool resolution precedent —
 * a mis-resolution here would reintroduce the exact production failure.
 *
 * Issues DescribeSecret ONLY — never GetSecretValue — so no secret value can reach
 * the resolved-ARN context map, the logs, or the synthesised template.
 */
export declare function resolveSecretArns(awsProvider: AwsProvider, names: string[]): Promise<Result<Record<string, string>>>;