import type { KubernetesTokenProvider } from '@cat-factory/integrations';
import type { SecretResolver } from '@cat-factory/kernel';
/** Static AWS credentials the SigV4 signature is computed from. */
export interface EksAwsCredentials {
    accessKeyId: string;
    secretAccessKey: string;
    /** Present for temporary (STS / assume-role) credentials; folded in as `X-Amz-Security-Token`. */
    sessionToken?: string;
}
export interface MintEksTokenParams {
    region: string;
    clusterName: string;
    credentials: EksAwsCredentials;
    /** Epoch ms for `X-Amz-Date`. Injectable so the token is deterministic in tests. Defaults to `Date.now()`. */
    now?: number;
    /**
     * STS host override, e.g. floci's emulated STS endpoint. Defaults to the regional public STS
     * host `sts.<region>.amazonaws.com`. Only the HOST is overridable (the scheme stays https).
     */
    stsHost?: string;
}
/**
 * Mint an EKS apiserver bearer token (`k8s-aws-v1.<base64url(presigned STS URL)>`).
 * Pure + deterministic given `now`.
 */
export declare function mintEksToken(params: MintEksTokenParams): Promise<string>;
/**
 * Build the async token provider `KubernetesApiClient` calls per request. It reads the AWS
 * credentials from the run's secret bundle and mints a token, caching it briefly so a single
 * transport call (e.g. an apply loop) mints once rather than per apiserver request.
 */
export declare function eksTokenProvider(cluster: {
    region: string;
    clusterName: string;
    stsHost?: string;
}, resolveSecret: SecretResolver): KubernetesTokenProvider;
/** Read the AWS credentials from the encrypted secret bundle. Throws if the required keys are absent. */
export declare function readAwsCredentials(resolveSecret: SecretResolver): EksAwsCredentials;
//# sourceMappingURL=eks-auth.logic.d.ts.map