secrets

type AWSSM struct {
	Client SecretsManagerAPI
	Region string // default region when ref omits one (unusual)
}

type CredentialOpener interface {
	Open(ctx context.Context, c snapshot.Credential) (string, error)
}

type CredentialResolver struct {
	Env   Env
	Box   *credentials.Box
	Vault Resolver // Multi or scheme-specific; required for storage_kind=vault
}

type Env struct{}

type Hashicorp struct {
	Addr   string
	Token  string
	Client *http.Client
}

type Multi struct {
	Env       Resolver
	AWSSM     Resolver
	Hashicorp Resolver
}

type ParsedRef struct {
	Scheme string // env | aws-sm | hashicorp | "" (bare env name)
	Path   string // secret id / vault path (no leading slash required)
	Key    string // optional JSON object key after #
	Raw    string
}

type Resolver interface {
	Get(ctx context.Context, ref string) (string, error)
}

type SecretsManagerAPI interface {
	GetSecretValue(ctx context.Context, params *secretsmanager.GetSecretValueInput, optFns ...func(*secretsmanager.Options)) (*secretsmanager.GetSecretValueOutput, error)
}