/**
 * AWS Secrets Manager Secret Resolver
 *
 * Reads secrets from AWS Secrets Manager.
 * Lazy-imports @aws-sdk/client-secrets-manager — optional peer dependency.
 * Uses AWS default credential chain (IAM roles, env vars, instance profiles).
 * Implements TTL-based caching to reduce API calls.
 *
 * Required peer dep: @aws-sdk/client-secrets-manager >= 3.0.0
 * Install: pnpm add @aws-sdk/client-secrets-manager
 */
import type { SecretResolver } from './types.js';
export interface AwsResolverOptions {
    region?: string;
    secretId?: string;
    cacheTtlMs?: number;
}
export declare class AwsSecretsManagerResolver implements SecretResolver {
    readonly name = "aws-sm";
    private client;
    private readonly region;
    private readonly secretId;
    private readonly cacheTtlMs;
    private cache;
    private cacheTimestamp;
    constructor(options?: AwsResolverOptions);
    /**
     * Lazy-import AWS SDK and create client.
     * Throws a clear error if the package is not installed.
     */
    private getClient;
    /**
     * Fetch all secrets from AWS Secrets Manager and cache them.
     * Expects the secret value to be a JSON string of key-value pairs.
     */
    private fetchSecrets;
    resolve(key: string): Promise<string | undefined>;
    resolveAll(keys: string[]): Promise<Record<string, string>>;
    dispose(): Promise<void>;
}
//# sourceMappingURL=aws-resolver.d.ts.map