import { type Result } from "@fjall/generator";
import type { AwsProvider } from "../../aws/AwsProvider.js";
export interface SsmParameterMetadata {
    name: string;
    version?: number;
    lastModifiedDate?: Date;
}
/**
 * Metadata-only SSM reads for the secrets-drift probe. Deliberately uses
 * DescribeParameters (never GetParameter/GetParameters): drift needs only
 * `LastModifiedDate` + `Version`, and a value-bearing call would put secret
 * contents in memory for no reason.
 */
export declare class SsmParameterMetadataService {
    private readonly awsProvider;
    constructor(awsProvider: AwsProvider);
    /**
     * Describe parameters by exact name. Names absent from the result simply
     * do not exist (or are not visible) — callers treat them as unknown, not
     * as an error.
     *
     * A success is a COMPLETE sweep of `names`: an abort part-way returns a
     * failure rather than the names read so far. The distinction is the whole
     * contract here, because absence is the consumer's "unknown" signal and a
     * partial success is indistinguishable from "these parameters are not
     * visible" — which a drift consumer reads as nothing-to-report, i.e. the
     * clean verdict. Fulfilling partial would make every caller's
     * `if (!result.success)` gate a gate over a failure mode that cannot
     * reach it (robustness-standards § "Destructive gates must consume the
     * producer's actual failure contract", shape 1).
     */
    describeParametersByName(names: string[], abortSignal?: AbortSignal): Promise<Result<SsmParameterMetadata[], Error>>;
}