import type { PreparedEffect, SecretValue } from '@kubricate/core';
import { SecretManager, type SecretOptions } from '../SecretManager.js';
import { SecretRegistry } from '../SecretRegistry.js';
import type { SecretsOrchestratorOptions } from './types.js';
export type StackName = string;
export type SecretManagerName = string;
/**
 * MergedSecretManager maps SecretManager instances at the project level.
 *
 * For now, Kubricate supports only one SecretManager per project (via config.secrets.manager),
 * so this structure holds exactly one manager under the 'default' key.
 */
export interface MergedSecretManager {
    [secretManagerName: string]: {
        /**
         * The name of the secret manager.
         * This is used to identify the secret manager in the project.
         */
        name: string;
        /**
         * The secret manager instance.
         */
        secretManager: SecretManager;
    };
}
export interface EffectsOptions {
    workingDir?: string;
}
/**
 * SecretManagerEngine orchestrates loading, validating, and preparing secrets
 * across all stacks defined in the Kubricate config.
 */
export declare class SecretManagerEngine {
    readonly options: SecretsOrchestratorOptions;
    constructor(options: SecretsOrchestratorOptions);
    protected normalizeSecretSpec(input: SecretManager | SecretRegistry): SecretRegistry;
    /**
     * Collect all SecretManager instances from the project config.
     *
     * @throws {Error} If both `manager` and `registry` are defined simultaneously.
     * @returns {MergedSecretManager}
     */
    collect(): MergedSecretManager;
    /**
     * Validate all connectors by attempting to load secrets and resolve their values.
     * Will throw if any secret can't be loaded.
     */
    validate(managers: MergedSecretManager): Promise<void>;
    /**
     * Prepare all effects (from providers) based on loaded secret values
     */
    prepareEffects(managers: MergedSecretManager): Promise<PreparedEffect[]>;
    /**
     * Load secrets from connectors, optionally returning the loaded values.
     * If `returnValues` is false, this acts as a validation-only step.
     */
    loadSecrets(secretManager: SecretManager, secrets: Record<string, SecretOptions>): Promise<Record<string, SecretValue>>;
}
//# sourceMappingURL=SecretManagerEngine.d.ts.map