import type { AwsCredentials, ProjectConfigResponse } from './types';
type AwsAccount = NonNullable<ProjectConfigResponse['aws']>['accounts'][number];
/**
 * Generate profile name from project code and account.
 * Uses profileName if available, otherwise falls back to name.
 * Format: {projectCode}-{profileName|name}
 */
export declare function getProfileName(projectCode: string, account: string | {
    name: string;
    profileName?: string;
}): string;
/**
 * Generate AWS config file content in INI format.
 * Contains profile definitions with region and SSO settings (if applicable).
 */
export declare function generateAwsConfig(projectCode: string, accounts: AwsAccount[]): string;
/**
 * Write AWS config file to project's aws directory.
 * Uses atomic write (temp + rename) with 0o600 permissions.
 */
export declare function writeAwsConfig(projectDir: string, projectCode: string, accounts: AwsAccount[]): void;
/**
 * Generate AWS credentials file content in INI format.
 */
export declare function generateAwsCredentials(projectCode: string, credentialMap: Map<string, AwsCredentials>): string;
/**
 * Write AWS credentials file to project's aws directory.
 * Uses atomic write (temp + rename) with 0o600 permissions.
 *
 * The filename includes a random per-call suffix (rather than a fixed
 * `credentials` name) because the same project directory can be shared by
 * multiple concurrent chat commands (including parallel Slack conversations).
 * A fixed shared path would let one command's cleanup delete a still-running
 * command's credentials file. Returns the absolute path actually written, or
 * `undefined` if the write failed (see the `try/catch` below).
 */
export declare function writeAwsCredentials(projectDir: string, projectCode: string, credentialMap: Map<string, AwsCredentials>): string | undefined;
/**
 * Delete the AWS credentials file written by writeAwsCredentials().
 * Takes the exact absolute path that was written (not a projectDir-derived
 * fixed path), so that cleaning up one call's credentials can never affect a
 * concurrent call's file. Also best-effort removes the `.tmp` companion file
 * that atomicWriteFile() can leave behind if its rename step fails.
 * Best-effort: does not throw if either file is already gone.
 */
export declare function cleanupAwsCredentials(credentialsPath: string): void;
/**
 * Sweep `awsDir` for orphaned `credentials-*` files (including `.tmp`
 * companions left behind by a failed atomicWriteFile() rename).
 *
 * Normally a credentials file is removed by cleanupAwsCredentials() when its
 * chat command finishes (success or error). But because each call now writes
 * to a uniquely-named file (rather than a fixed shared `credentials` path —
 * see writeAwsCredentials() above), a chat command's SIGKILL/OOM before
 * cleanup runs leaves a plaintext-AWS-credentials orphan behind permanently:
 * unlike the old fixed-name scheme, there is no next write to overwrite it.
 * Sweeping on every config sync self-heals this, mirroring
 * cleanupStaleCommandMcpConfigs()'s design for per-command MCP configs.
 *
 * @param awsDir getAwsDir(projectDir) — the project's aws directory
 * @param maxAgeMs delete entries at least this old (ms). Default 24h; 0
 *   removes every matching entry regardless of age
 * @returns number of entries removed
 */
export declare function cleanupStaleAwsCredentials(awsDir: string, maxAgeMs?: number): number;
/**
 * Build environment variables for Claude Code to use AWS profiles.
 * Sets AWS_CONFIG_FILE to the project's shared config path and
 * AWS_SHARED_CREDENTIALS_FILE to the caller-supplied credentials path
 * (the exact file written by writeAwsCredentials() for this call).
 * Optionally sets AWS_PROFILE and AWS_DEFAULT_REGION for the default account.
 */
export declare function buildAwsProfileEnv(projectDir: string, projectCode: string, credentialsPath: string, defaultAccountName?: string, defaultRegion?: string): Record<string, string>;
export {};
//# sourceMappingURL=aws-profile.d.ts.map